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Title : (U// FQUQ ) Opening of Full Investigation on 
a Sensitive Investigative Matter (SIM) 


Date: 07 / 10/2015 


CC: 


FBI INFO. 

CLASSIFIED BY: HSICC- JS7JG5T34 
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From: 


COUNTERINTELLIGENCE 

D5-CD4 


DECLASSIFY CQJ: 12-31-2D4D 
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A/ DAD David W Archey 
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MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 
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DOCUMENT RESTRICTED TO CASE PARTICIPANTS 

This document contains information that is restricted to case participants* 


'jji . 

Synopsis: 1 ' ) FBIHQ, Counterespionage Section, is opening a full 

investigation based on specific articulated facts provided by an 811 
referral from the Inspector General .of the Intelligence Community, 
dated July 6, 2015 regarding the potential compromise of classified 
information. 


(Ui 

j — 

231 

Full Investigation Initiated: 07/10/2015 
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T// NOFORN 

Title: (U/ / FOUO ) Opening of Full Investigation on a Sensitive 

Inve stigative Matter (SIM) 

Re: I 07/10/2015 


Enclosure (s) : Enclosed are the following items: 

1. (U/ / rOUO) Referral documents received from ICIG 

Details: 

($£&£) FBIHQ, Counterespionage Section, is opening a full investi 
gation based on specific articulated facts provided by an 811 referral 
from the Inspector General of the Intelligence Community (ICIG), dated 
July 6, 2015 regarding the potential compromise of classified 
information. 

(U/ / FOUO ) The purpose of this investigation is to detect, obtain 
information about, and protect against federal crimes or threats to the 
national security. The initiation of this Full Investigation is based, 
as per AGG-Dom II. B. 3 and DIOG Section 7.5, on activity constituting *a 
federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur and the 
investigation may obtain information relating to the activity or the 
involvement or role of an individual, group, or organization in such 
activity. 

JS^/Wfr The ICIG referral provided a sample unclassified e-mail 
that, allegedly contains information at a classified and SCI level. 
According to the ICIG, this e-mail was part of a larger trove of other 
unclassified e-mails they were reviewing during their own 
investigation . 

X //W ^ The following documentation was provided by the ICIG and 
will be kept in the 1A section of the case file. 


1) 811 referral letter from the ICIG dated July 6, 2015 regarding 
Potential Compromise of Classified Information* 

2) Letter from the ICIG dated June 19, 2015 regarding Update to IC 
IG support to State Department IG. 

3) Letter from the ICIG dated June 25, 2015 regarding Classified 
Material on Personal Storage Devices. 

4) E-mail dated April 10, 2011 with example of potential inclusion 
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Title: (U// FOUQ ) Opening of Full Investigation on a Sensitive 

Investigative Matter (SIM) 

Re: I I 07/10/2015 


of classified information contained in an unclassified e-mail. 

5) Letter from Williams & Connolly LLP dated June 24, 2015 regarding 
preservation efforts related to e-mails. 

(^^F) Due to the extremely sensitive nature of this 
investigation and the damage its disclosure could cause, the case will 
be designated as a prohibited investigation in accordance with the 
Counterintelligence Division Policy Implementation Guide. Author 
requests Assistant Director concurrence to maintain the identified case 
as prohibited. 

This investigation is also designated a Sensitive 
Investigative Matter (SIM) due to a connection to a current public 
official, political appointee or candidate as defined in Section 
10.1.2.2.2 of the DIOG. 


: .U! Additionally, an Assistant .Director exemption for 

uploading to Sentinel is requested. Since the ICIG referral alleges 
classified SCI material may have been compromised, all investigative 
work will be conducted on SCION. As documents to the case file are 
added, a placeholder will be entered into Sentinel and a serial number 
assigned to the document. Electronic copies of the case serials will 
be stored on SCION. The physica l case file documents will be stored in 

a currently certified SCIF. 


a locked file cabinet located ini 
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U. S. Department of Justice 



Federal Bureau of Investigation 


In Reply, Please Refer to Washington DC, 20535 

File No. July 13, 2015 


(U) OPENING LHM FOR FULL INVESTIGATION ON USPER 


(D) Subject (s) Name: UNKNOWN SUBJECT 

(U) Preliminary Investigation 

(U) X Full Investigation 

. Single subject 

X Multi-subject 
Enterprise 

Foreign intelligence collection 


CLASSIFIED BY : NSICG J37JS5T94 
REASON: 1.4 (C; 

DEC LASS 1ST CN 12-31-2040 
DATE' 10-27-2016 


ALL INFORMAT ION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOV/1I OTHERWISE 


(U) Investigation initiated by: Field Office or X FBI HQ 

(U) FBI HQ/DO J notice via LHM required (if yes to any below) : 

X A. full on USPER 

X B. SIM (PI or full) 

C. enterprise investigation 

1 D. foreign intelligence case 

(D) I ■ Purpose of the Investigation : 

Check the appropriate purpose for which the investigation is being 
initiated, as per AGG-Dora II.B.l and DIOG 1 '6.2 and 7.2: 

ClassifiecT'-Bir: C5^WT5B90 

Derived FromT^FBt^NSIC dated 20130301 

Declass if v-On: 2040^313 


Page 1 of 4 


This document contains neither recommendations nor conclusions of the FBI . It is the 
property of the FBI * and is loaned, to your agency; it and its contents are not to be 
distributed outside your agency. 



SECRET, 


bl 

b3 

b7E 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER 
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X_ A. To detect, obtain information about, or prevent or 

protect against federal crimes or threats to the national 
security. 

B. To collect foreign intelligence. (Full investigations 

only) 


(U) II. Predication for the Investigation : 

Appropriate circumstances: Check the appropriate circumstance (s ) 
on which the initiation of the Preliminary investigation or Full 
investigation is based, as per AGG-Dom II. B. 3 and DIOG Sections 6.5 
and 7.5; 

X A. (U) An activity constituting a federal crime or a threat 
to the national security has or may have occurred, is or may be 
occurring, or will or may occur and the investigation may obtain 
information relating to the activity or the involvement or role of an 
individual, group, or organization in such activity; 


B. (U) An individual, group, organization, entity, 

information, property, or activity is or may be a target of attack, 
victimization, acquisition, infiltration, or recruitment in connection 
with criminal activity in violation of federal law or a threat to the 
national security and the investigation may obtain information that 
would help to protect against such activity or threat. 


__ C. (U) The investigation may obtain foreign intelligence that 
is responsive to a Positive Foreign Intelligence Requirement, as 
defined in DIOG Section 7.4.C. [Full investigations only] 

: ,U1 FBIHQ, Counterespionage Section, is opening a full 

investigation based on specific articulated facts provided by an 811 
referral from the Inspector General of the Intelligence Community. 

( ICIG) , dated July 6, 2015 regarding the potential compromise of 
classified information. 

(U/ /-FOU0) The purpose of this investigation is to detect, obtain 
information about, and protect against federal crimes or threats to 
the national security. The initiation of this Full Investigation is 
based, as per AGG-Dom II. B, 3 and DIOG Section 7.5, on activity 
constituting a federal crime or a threat to the national security has 
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SENSITIVE INVESTIGATIVE MATTER 


b3 
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or may have occurred, is or may be occurring, or will or may occur and 
the investigation may obtain information relating to the activity or 
the involvement or role of an individual , group, or organization in 
such activity. 

The ICIG referral provided a' sample unclassified e-mail 
that allegedly contains information at a classified and SCI level* 
According to the ICIG, this e-mail was part of a larger trove of other 
unclassified e-mails they were reviewing during their own 
investigation. 

ill? The following documentation were provided by the ICIG and 

will be kept in the 1A section of the case file. 

1) 811 referral letter from the ICIG dated July 6, 2015 regarding 
Potential Compromise of Classified Information. 

2) Letter from the ICIG dated June 19, 2015 regarding Update to 
IC IG support ‘to State Department IG. 

3) Letter from the ICIG dated June 25, 2015 regarding Classified 
Material on Personal Storage Devices. 

4) E-mail dated April 10, 2011 with example of potential 
inclusion of classified information contained in an unclassified 
e-mail. 

5) Letter from Williams & Connolly LLP dated June 24, 2015 
regarding preservation efforts related to e-mails. 
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(U) IV- Certification: 


The case agent and all approving personnel certify tha t : 

X A* An authorized purpose and adequate predication exist 

for initiating the preliminary or full investigations ; 

x B . The investigation is not based solely on the exercise 
of First Amendment activities or race, religion, 
national origin or ethnicity of the subject; and 

x C- The investigation is an appropriate use of personnel 
and financial resources. 


(U/ /fOUQ) The poi nt of contact for this i nvestigation is 


Assistant Section Chief 


telephone number | | 
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ALL INFQRiiAT IQH CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 


■T/ZM OrOW T 


CLASSIFIED EY: NSIC-G J37JS5T34 
REASON: 1.4 (C) 

DECLASSIFY' ON: 12-31-2040 
DATE: 10 - 2 7-2 016 



U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 
File No. 

21 July 2015 

To: Sally Quilliati Yates 

Deputy Attorney General 
Department of Justice 


From: Mark F. Giuliano 

Deputy Director 

Federal Bureau of Investigation 


Subject: 

MISHANDLING of CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 

J IT i 

(5?7tfF) On 13 July 2015 and 20 July 2015, I verbally advised 
you of a Section 811{c) referral from the Inspector General of the 
Intelligence Community received by the FBI on 06 July 2015. The 
referral addressed the mishandling of classified- information on the 
personal e-mail account and electronic media of a former high-level 
SJ US Government official. On 10 July 2015 . the FBI initiated a full 

investigation, J.n response to the referral. 

Two copies of the opening letterhead memorandum for the investigation 
are attached for the information of the Department of Justice. 

(U/ / FQUQ ) The point of contact for this investigation is 
Assistant Direct or Randall C . Col eman, Counterintelligence Division, 
telephone number 
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Mark F. Giuliano 
FBI, Deputy Director 


Derived Fr^T[rj-~~ > ^u±triple Sources 
De cl^eiTyorr~^G 401 2 3 1 

SBgRgT/ /NOFORH 
1 
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07/21/2015 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 10-27-201C BY J37285T94 MS ICC 


please have the DD sign these two documents. One will be provided the DAG/DOJ and the other 


copy will be placed in our records here at FBIHQ. 




Va \ 1-(Z3 



b>6 
hi C 


HRC-369 




b6 

b7C 



HRC-374 



U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


ALL II-TFORilATIOH CCKTAIHEE 

3E3EIM IS UHC LAS SIFTED 

DATE 10-27-2016 BY J37J85TS4 HSICG 



July 27, 2015 
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Re: Request for Preservation of Records 


Dear 


be 

b7C 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a fo rmal reque st for 
the preservation of all records and other evidence in your possession regarding the | | 


Jpending 


Y ou are hereby requested to pi tiv - cl^Mfced below currently in your 

possession, including records stored oah^fcjp a that includes the complete 

record, and records that may come int^Hry date of acknowledgment of this 

request until receipt of a legal court or^^* not to disclose the existence 

of this request to the subscriber or any o-: necessary to comply with this 

request, as the FBI's investigation mayfca . of disclosure. You are also 

requested not to close the account of t oer, ^^^^^^sted to do so by the subscriber. 

If compliance with this request may result in a permanent or temporary termination of service 
to the accounts described below, or otherwise alert the subscriber or user of these accounts as 
to your actions to preserve the referen ced files and records, please contact Special Agent 

as soon as possible and before taking any such actions. 


This preservation request applies to the following records and evidence: 


A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. All records and other evidence relating to the subscribers), customer(s), account 
holder(s), or other entity (ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 
identity, billing records, information about the length of service and the types of 
services the subscriber or customer utilized, and any other identifying 


be 

b7C 
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HRC-375 


* • 

information, whether such records or other evidence are in electronic or other 
form; and 

C. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

D. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this reques t, please direct a ll inquiries to 
Special Agent ~|ndio can be reached at 


b6 
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Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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ALL II'irORI'dS.T IQl'J CONTAINED 
HEREIN IS UNCLASSIFIED 


U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



July 28, 2015 

b7E 


Re: Request for Preservation of Records 

Dear Sir or Madam: 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a for mal requ est for 

the preser vation of all records and other evidence in your possession regarding the 

| pending further legal process. 

1.1 

2 . 

3. 

4. 

5. 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
of this request to the subscriber or any other person, other than as necessary to comply with this 
request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also 
requested not to close the account of the subscriber, unless requested to do so by the subscriber. 
If compliance with this request may result in a permanent or temporary termination of service 
to the accounts described below, or otherwise alert the subscriber or user of these accounts as 
to your actions to preserve the referen ced files and records, please contact Special Agent 

as soon as possible and before taking any such actions. 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 
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• • 

B. All records and other evidence relating to the subscribers), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
maili ng addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 
identity, billing records, information about the length of service and the types of 
services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other 
form; and 

C. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

D. Any other records and other evidence relating to the requested account Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this reques t, please direct a ll inquiries to 


Special Agent 


who can be reached at 
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Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



July 27, 2015 


Re: Request for Preservation of Records 


Dear 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a for mal req uest for 
the preservation of all records an d other evidence in your possession regarding the | 

pending further legal process. 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
of this request to the subscriber or any other person, other than as necessary to comply with this 
request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also 
requested not to close the account of the subscriber, unless requested to do so by the subscriber. 
If compliance with this request may result in a permanent or temporary termination of service 
to the accounts described below, or otherwise alert the subscriber or user of these accounts as 
to y our actions to preserve the refere nced files and records, please contact Special Agent 

as soon as possible and before taking any such actions. 


This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. All records and other evidence relating to the subscribers), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 
identity, billing records, information about the length of service and the types of 
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services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other 
form; and 

C. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6 . T elephone caller identification records ; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

D. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this reque st, please direct a ll inquiries to 
Special Agen j who can be reached at | 


be 
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Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



July 27, 2015 


Re: Request for Preservation of Records 


Dean 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a fo rmal reque st for 
the preservation of all records and o ther evidence in your possession regarding the j 

pending further legal process. 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
of this request to the subscriber or any other person, other than as necessary to comply with this 
request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also 
requested not to close the account of the subscriber, unless requested to do so by the subscriber. 
If compliance with this request may result in a permanent or temporary termination of service 
to the accounts described below, or otherwise alert the subscriber or user of these accounts as 
to your actions to preserve the refere nced files and records, please contact Special Agent 

as soon as possible and before taking any such actions. 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity (ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 
identity, billing records, information about the length of service and the types of 
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services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other 
form; and 

C. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; - 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

D. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this reque st, please direct al l inquiries to 


Special Agent] 


who can be reached at] 


be 

b7C 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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July 24, 2015 


VIA ELECTRONIC TRANSMISSION 

The Honorable James B. Comey, Jr. 

Director 

Federal Bureau of Investigation 
935 Pennsylvania Avenue, NW 
Washington, D.C. 20535 

Dear Director Comey: 

The Inspector Genera! of the Intelligence Community (IC) and the Inspector General of 
the State Department (State OIG) recently notified the: FBI and several Intelligence Community 
agencies of a compromise of national security information in connection with Hillary Clinton’s 
use of a non-governmental email server while Secretary of State. Specifically, in a sample of 40 
of Secretary Clinton’s emails IC identified four containing classified IC-derived information. 
These recent revelations raise important questions about the role the Federal Bureau of 
Investigation (FBI) has taken and will continue to take in this matter. In addition, a notification 
from the IC indicates that these classified emails existed on a thumb drive and may exist on a 
server. According to a briefing provided today by the IC and State OIGs, former Secretary 
Clinton’s persona! attorney, David Kendall, was in possession of the thumb drive at the time of 
the notice to the FBI and other IC components. This raises very serious questions and concerns 
if a private citizen is somehow retaining classified information. 

Accordingly, please explain whether Mr. Kendall had the requisite security clearance and 
authorization to be the custodian of classified national security information. If not, please 
explain what steps the FBI has taken or plans to take to secure and prevent further dissemination 
of the classified information contained on the thumb drive. In addition, what steps are being 
taken to hold anyone in this matter accountable for unauthorized possession of classified 
material? 

If you have any questions, contact Josh Flynn- Brown of my Committee Staff at (202) 224- 

5225. 

Sincerely, 

Charles E, Grassley 
Chairman 

Committee on the Judiciary 
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We ask that this be an unclassified report, and that a classified annex be provided if 
necessary. Thank you for your time, and we look forward to working with you oil this 
important matter of national security. 


Sincerely, 




Chairman Bob Corker 

Senate Foreign Relations Committee 



Chairman Richard Burr 

Senate Select Committee on Intelligence 


Chairman fflotwohnson 
Senate Homeland Security and 
Governmental Affairs Committee 
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TREY GOWDY, SOUTH CAROLINA 
Chairman 


IYNN WESTMORELAND, GEORGIA 
JIM JORDAN, OHIO 
PETER ROSKAM, ILLINOIS 
MIKE POMPEO, KANSAS 
MARTHA ROBY, ALABAMA 
SUSAN W. BROOKS, INDIANA 

PHILIP G. KIKO, Staff Director 


jlLL FBI lUFORKATICW CONTAINED 
| HEREIN IS UNCLASSIFIED 


Congress of tfjc Uniteti States 

House of &epresentattoes 

Select Committee on Benghazi 

1036 Longworth House Office Building 
Washington, D.C. 20515-6090 
(202) 226-7100 
http:/fbenghazi. house.gov 


ELIJAH E. CUMMINGS, MARYLAND 
Ranking Minority Member 

ADAM SMITH, WASHINGTON 
ADAM B. SCHIFF, CALIFORNIA 
LINDA T. SANCHEZ, CALIFORNIA 
TAMMY DUCKWORTH, ILLINOIS 

114™ congress 

SUSANNE SACHSMAN GROOMS, Minority 
Staff OtR ector 


July 22, 2015 


The Honorable James B. Comey 
Director 

Federal Bureau of Investigation 
935 Pennsylvania Avenue, NW 
Washington, DC 20535 

Dear Director Comey: 

The House of Representatives charged and empowered the Select Committee on 
Benghazi to review the events before, during, and after the 2012 attacks in Benghazi, Libya and 
specified related matters. During the pendency of our investigation, the Committee has 
discovered facts suggesting the existence of issues of significant legislative and oversight 
concern. 'I now understand a formal referral has been made to the Federal Bureau of 
Investigation by impartial officials within the Executive Branch regarding potential investigative 
issues flowing from some of these facts. 

While the Committee’s work will continue for legislative, oversight, and reform 
purposes, it is important the Bureau also immediately consider whether a thorough, independent, 
and nonpartisan review of the matters referred to it, as well as issues attendant thereto, is 
warranted. This is necessary to ensure the laws are enforced fairly, evenly, and impartially 
wherever the relevant facts may lead. The Bureau is in the best and most appropriate position to 
evaluate the complete range of counterintelligence and public integrity equities that may be 
implicated. Only the Bureau can accomplish this in a way that ensures public confidence in a 
fair, timely, and exhaustive investigation of these matters. And the Bureau is uniquely well 
suited to ensure this is accomplished free of any external factors save the facts applied 
assiduously to the law and devoid of either real or perceived political influence. 

The principles at bar are particularly important with respect to counterintelligence 
equities and the handling, retention, and storage of classified information. The Department of 
Justice has recently applied a consistent standard of aggressive and evenhanded investigation in 
cases ranging from Edward Snowden to David Petraeus in order to unambiguously deter future 
mishandling and disclosure. I understand significant concerns have been referred to the Bureau 
in this area based on the objective assessment of an interagency review that included consultation 
with the officials responsible for determining what information is classified. The facts 
underlying this referral potentially implicate the same important interests the Department has 
steadfastly sought to protect in the past. 
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Similarly, the Department has thoroughly investigated matters relating to the handling of 
evidence relevant to potential or ongoing investigations and the accuracy of representations made 
to Congress even in sensitive national security cases. While I expect the Committee will 
continue to explore relevant facts and issues within its charter, the Committee is willing to 
provide access to any information currently obtained during the course of our investigation that 
may inform and instruct matters raised in the referral. 

You have spoken in the past about “the reservoir of credibility and trust that is the 
Department of Justice” and you have stated “I am a huge believer in the rule of law, but I also 
believe that no one in this country is beyond the law.” I could not agree with you more. Your 
work is ultimately judged, as mine once was, by the blindfolded woman holding nothing but a set 
of scales and a sword. The evenhanded application of foe law and the dogged, impartial pursuit 
of the facts are foe hallmarks of justice. 

1 hope you will carefolly consider these matters. They are outside the purview of what 
our Committee has been asked to do, but clearly within the four comers of what you have been 
asked to do. 



cc: The Honorable John Boehner 

Speaker of foe House 

The Honorable Elijah Cummings 
Ranking Member 
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U.S. Department of Justice 


Federal Bureau of Investigation 

Washington, D.C. 20535*0001 
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July 27, 2015 

Steve Linick 
Inspector General 
U.S. Department of State 
Room 8100, SA-3 
2201 C Street, N.W. 

Washington, DC 20520-0308 

Re: Request for Preservation of Records 

Pursuant to Title 18, United States Code Section 2703(1), this letter is a formal request for 
the preservation of all records and other evidence in your possession regarding the domain 
account @clintonemail.com and the @sta te.gov email accounts associated with the following 
U.S. Department of State employees, pending further legal process. 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
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of this request, other than as necessary to comply with this request, as the FBI’s investigation 
may be jeopardized by this type of disclosure. 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. The contents of any communication or file stored by or for the accounts and any 
associated accounts, and any information associated with those communications 
or files, such as the source and destination emails addresses and IP addresses. 

C. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

D. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this reques 
Special Agent who can be reached at 


please direct a ll inquiries to 


Sincerely, 


be 

b7C 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



July 31, 2015 

David Kendall, Esq. 

Katherine Turner, Esq. 

Law Offices of Williams & Connolly LLP 
725 Twelfth Street, N.W. 

Washington, D.C. 20005 

Re: Request for Preservation of Records 

This letter is a formal request for the preservation of all records and other evidence in 
your possession, or in the possession of your client, Hillary Clinton, regarding the domain 
account @cliii tonemail.com, pending further legal process. 

You are hereby requested to preserve the records described below currently in your 
possession, or in the possession of your client, including records stored on backup media, in a 
form that includes the complete record, and records that may come into your possession from the 
date of acknowledgment of this request until receipt of a legal court order. You are also 
requested not to disclose the existence of this request, other than as necessary to comply with this 
request, as the FBI's investigation may be jeopardized by this type of disclosure. 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested domain account. 

B. All servers, computers, thumbdrives, hard drives, smartphones, or any other 
digital storage devices in your possession or in the possession of your client, 
which may contain communications to or from the requested domain account. 

C. All business records and other evidence relating to the establishment of the 
domain referenced above, including subscriber(s), customer(s), account 
holders), or other entity(ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 
identity, billing records, infomiation about the length of service and the types of 
services the subscriber or customer utilized, and any other identifying 
infomiation, whether such records or other evidence are in electronic or other 
form; and 
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D. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

E. Any other business records and other evidence relating to the requested account. 
Such records and other evidence include, without limitation, correspondence and 
other records of contact by any person or entity about the above-referenced 
account, the content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


Special Agen{ 


If you have any question s regarding this reque st, please direct a ll inquiries to 


who can be reached an 


b6 

b7C 


Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


ALL INFORMATION CONTAINED 
IS UNCLASSIFIED 



July 29, 2015 

John Kerry 
Secretary of State 
U.S. Department of State 
Washington, DC 20520 


Re: Request for Preservation of Records 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all records and other evidence in your possession regarding the domain 
account @clintonemail.com and the @state.gov email accounts associated with the following 
U.S. Department of State employees, pending further legal process. 


1 . 

2 . 

3. 

4. 

5. 

6 . 

7. 

8 . 

9. 

10 . 

11 . 

12 . 
13, 
14 

15. 

16. 

17. 

18. 
19. 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
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of this request, other than as necessary to comply with this request, as the FBI's investigation 
may be jeopardized by this type of disclosure. 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. The contents of any communication or file stored by or for the accounts and any 
associated accounts, and any information associated with those communications 
or files, such as the source and destination emails addresses and IP addresses. 

C. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, duringJhe 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to thc 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

D. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any question s regarding this request 
Special Agent ! | who can be reached at! 


ilease direct a ll inquiries to 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07/30/20 1 5 


On 07/29/2015, at approximately 3 p.m.. Special Agents 
served a preservation letter addressed to Steve A. Linick. I 
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Investigation on 07/29/2015 at Washington^ PC 


Date dictated N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07/3 0/20 15 
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am 
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On 07/29/2015, at approximately 3:28 p.m +s Special Agents | 

~~|served a preservation letter addressed to Jo h n Kerry, Secretary of State, U.S. Department of State 

Executive Assistant for Patrick F. Kennedy, Under Secretary for 


Management, Department of State. 
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The preservation letter was served at U.S. Departm ent of State’s Visitor Center, 2201 C Street, 


NW, Washington, DC 20520. 

I 1 


provided her contact phone number as | | 
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Investigation on 07/29/2015 
File# J I 


at Washington, DC 

' Date dictated N/A 
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ALL IHFOKIIATIOH CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 10-31-2015 BY J37J85T34 NS ICC 





From: 

Sent: 

To: 

Subject: 

Attachments: 


Friday. July 31. 2015 8:21 AM 

I I fCD) {FBI} ( 

Preservation Confirmation H | 

1212643.tif; Notice - Addressing of Legal Demands .pdf 
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Hellol 


FBI, Washington DC , 


H has received your preservation request(s) on the account name(s) listed in the attach ed fax[ 
preserve the requested account data, if any account data exists, for a period of 90 days from 30 July 201 5, | 
you whether any data exists for the accounts that are subject to your preservation request. 


|will 

Jcannot advise 
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Your preservation record number isj 
any preserved data. 


Be sure to refer to this record number when requesting the disclosure of 


18 U.S,C, 2703(f)(2) of the Electronic Communications Privacy Act permits a single 90 extension for each preservation request. If we 
do not receive a preservation extension request within 90 days from the date of this preservation letter, the preserved data will be 
destroyed. Also, please be aware that preservations are merely one time snapshots of the account on the date the information is 
preserved. Preservations are not snapshots made each day during the 90 day preservation timeframe. 

If you send an extension to your preservation request, please indicate that your request is an extension so we may quickly identify the 
account that you preserved and ensure that the initial data preservation is maintained. 


Finally, when you submit your legal request for us to disclose the preserved data, please provide the preservation request number 
along with the date of the original preservation so that j may retrieve all relevant stored data* 


Thank you, 
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ALL FBI IMFORllATICM' CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 10-31-201« BY J37J85T34 NSICC 


UNDER SECRETARY OF STATE 
FOR MANAGEMENT 
WASHINGTON 

JUL 30 2015 


Dear Mr. Kable: 

This letter is to acknowledge your letter of July 29, 2015, to Secretary Kerry 
in which you made a formal request for the preservation of all records or other 
evidence in the Department of State’s position regarding the domain account 
@clintonemail.com and the @state.gov email accounts for 19 former and current 
personnel. 

The preservation request has been tasked to the appropriate Department of 
State personnel for execution. 


My point of contact for your req uest is my Executi ve Assistant| 
Iwho can be reached at 


Regards, 



Patrick F. Kennedy 


Mr. Charles H. Kable IV, 

Section Chief, 

Counterintelligence Division, 

U.S. Department of Justice, 

Federal Bureau of Investigation, 

Washington, D.C. 20535-0001. 
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Mr. Charles H. Kable IV, Section Chief 
Counterintelligence Division 
U.S. Department of Justice 
Fpriera l Bureau of Investigation 
c/o Mr ] 

Washington, D.C. 20535-0001 
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Event Title : 


Collected Item Log 


Date: 08/06/2015 


Approved By: 


Drafted By: 


Case ID # : 


St^ V 1 

(S/y4H> 

MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER 


(SIM) 


bl 

b3 

b7E 


b6 

b7C 


bl 

b3 

b7E 



Collected From: (U) Katherine Turner, Esq 
Williams & Connolly, LLP 
725 12th Street, NW 
Washington 

Receipt Given? : No 

Holding Office: WASHINGTON FIELD 

Details: No Details Provided 

Item Type Description 


T/ /NO FORM 


This document contains neither recommendations nor conclusions of the FBI. Jt is the property of the FBI and is loaned to your agency; it and its 
contents are not to be distributed outside your agency. 
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Title : 
Re : T 


08/06/2015 
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IB Digital (U) 1 Lexar micron 16 GB Black & Silver Thumbdrive - 

LJDTT166-000-1001 DA (Original) 

ILexar Micron 8 GB Green and White 
L JDTT8GB-00 0-117AU (Copy 1} 

1 Kingston 8GB Silver DT SE9 (Copy 2 ) 

Collected On: 08/06/2015 

Seizing Indivi dual : | | 

Collected By: 

Location Area : NA 
Specif ic Location : NA 

Device Type: USB Micro Storage Device (thumb drive) 
Number of Devices Collected: 3 

IB Digital (U) Lenovo Think Pad T420 PB-YC912 12/03 

Collected On: 08/06 /2015 

Seizing Indivi dual : I | 

Collected By: | 

Location Area: NA 
Specific Location: NA 

Device Type : USB Micro Storage Device (thumb drive) 
Number of Devices Collected: 1 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


ALL IMFOKMATIOH COHTAIHEE 
3Z3ZIH IS UHC LAS SIFTED 



August 5, 2015 

John Kerry 
Secretary of State 
U.S. State Department 
2201 C Street, NW 
Washington, DC 20520 


Re: Request for Preservation of Records 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all records and other evidence in your possession regarding the @state.gov 
email account associated with Bryan Pagliano, pending further legal process. 

You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
of this request, other than as necessary to comply with this request, as the FBI's investigation 
may be jeopardized by this type of disclosure. 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. The contents of any communication or file stored by or for the accounts and any 
associated accounts, and any information associated with those communications 
or files, such as the source and destination emails addresses and IP addresses. 

C. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 


HRfC-451 



5 . User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

D. Any other records and other evidence relating to the requested account. Such 

records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any question s regarding this reque st, please direct a ll inquiries to 


Special Agent 


who can be reached at 


Sincerely, 


b6 

b7C 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


HRC-452 



hS 

b7C 



HRC-453 


FD-302a (Rev. 10-6-95) 


- 1 - 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

BATE 10-31-201G BY J37J35T34 NSIC 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/03/201 5 


On August 3, 2015, 


Records 


Management Division, Records- Information and Dissemination Section, 
Winchester, Virginia provided the enclosed internal email 
communications referencing the FBI's classification of a Nov ember 1 8 . 


in 


2012 State Department email. The enclosure was provided by 
support of statements made during a July 30, 2015 FBI interview and 

documents items discussed at that time. The enclosure has an overall 
classification of SECRET/ /NOFORN. 


b6 

b7C 


Investigation on 08/03/201 5 


File# 


at Washington, D.C. 

Date dictated N/A 


By SM 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


b3 

b7E 


b6 

b7C 


HRC-454 



DECLASSIFIED BY: 13SICG J37JB5T34 
DU 10 “31 “2015 


NFMFB 1 ! 

a 


From: 

Sent: 

To: 

Subject: 


RMD) (FBI) 


Monday. August 03. 201 5 2:00 PM 
I l (NF)(FBI);[ 


Emails — OCCRCT//HOronN 


SentinelCaseld: TRANSITORY RECORD 


](LA)(FBI) 


b 6 
b7C 


Classification: 

Classified By: JZ3J38T32 

Derived P^oml^FB I NSIC dated 20130301 

Declassi&rOnj 50X1-HUM' 


TRANSITORY RECORD 


| b6 

b7C 

Attached are the emails I preserved. The last one probably isn't responsive, but you don't get very many like it. 

For the three emails in which there was no classified FBI information and we did not require any changes, I'll forward 
them shortly. Do want the email chain as well for them? 


■B 

State Dept 
Emails.pdf 


Classification : SEC 




l 


HRC-455 


1 





% 



CECLASSItlEC BY: H5ICG J37JS5T34 


ON 1 0 “ 31 “2014? 

RMD) (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 


I RMD) (FBI) . 

IMblTd^ADnirQ6W5^2WPML 

| CTD)(FBI) 

[ RMD) (FBI); JUPINA, MICHELLE A (RMDJ(FBl); NEAGLE, LOUISE M 

(RMD)(FB!) 

State [Department Emails --FOIA Coordination — SEGRET 


b6 

b7C 


Importance: High 

SentinelCaseld: TRANSITORY RECORD 


Classification: 


ClassiTrai_j3y: J23J98TJ^ 

Derived dated 20120629 

De c 1 a s s i fit-0trr2 oToil 


TRANSITORY RECORD 


b6 

b7C 


Attached is an email forwarded to us by State Dept, for coordination. The email concerns Benghazi It is from former 
Sec, Clinton's emails. They've asked for us to finish our review by COB tomorrow. Coutd you highlight any classified, LES 
information? I'm at HQ today, t classified this email out of caution. 

■ffi 

C0S739808 - FBI H-0003.pdf 
Work.pdf 


Thanks, 

b6 

b7C 


Classification: 


HRC-456 




DECLASSIFIED BY: HSICG J3U85T34 
□tl 11-07-2G1S 



Subject: FW: State Department Emails — FOIA Coordination — -SECRET 

Importance: High 

SentinelCaseld: TRANSITORY RECORD 


Classification :/SECRET 

Classif ie^x^y : J23J98T32 
Derived^romK^BI NSIC, dated 20120629 
Declassify On: 2<^401231 

TRANSITORY RECORD 


As we discussed, attached is the email for review. 



Se nt: Monday, April 06, 201 5 2:37 PM 
To:| tCTDXFBI) 

Cc: | I fRMD) (FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(FBI) 

Subject: State Department Emails -*F0IA Coordination — SECR E T 
Importance: High 


b6 

b7C 


b6 

b7C 


Clas^f icat ion : SECRET 

Class if J23J93T32 

Derived NSIC, dated 20120629 

Declas^dTry 00:^0401231 


TRANSITORY RECORD 

b6 
b7' 

Attached is an email forwarded to us by State Dept, for coordination. The email concerns Benghazi, It is from former 
Sec, Clinton's emails. They've asked for us to finish our review by COB tomorrow* Could you highlight any classified, LES 
information? I'm at HQ today, l classified this email out of caution* 

1 



HRC-461 




■B- *B 

C057398O8 - FBI H-0OO3.pdf 
Work.pdf 


Thanks, 



HRC-462 



DECLASSIFIED BY: MS ICG 
OH 11-07-2016 


J37085T34 




From: 

Sent: 

To: 

Cc: 

Subject: 



_|CTD)(FB1); JUPINA, MICHELLE A (RMD)(FBl[ 


J(RMD) (FBI); NEAGLE, LOUISE M (RMD)(FBI) 

:: State Department Emails -FOIA Coordination — 


3ECRCT 


SentinelCaseld: TRANSITORY RECORD 


b6 

b7C 



I 1 

Thanks! State emailed me and said they have 55,000 pages to review for our equities. 


From: 


Se nt: MondaiMTAPni 


To:J 

Cc: 


(CTD)(FBI) 
at5> SfS8iRMi 


b6 

b7C 


RMD) (FBI) 

](CTD)(FBI); JUPINA, MICHELLE A {RMD)(FBI)£ 


LOUISE M (RMDXFBI) 

Subject: RE: State Department Emails --F0IA Coordination — SECRET 


(RMD) (FBI); NEAGLE, 



TRANSITORY RECORD 



b6 

b7C 

~~l is working on this as we speak. If all goes as planned we should be able to get this out by noon tomorrow. 

He is going to have it packaged for me to run by the front office in the morning. 

Respectfully, 



1 


HRC-463 



b6 

b7C 


From£ 


(RMD) (FBI) 


Se nt: Monday, April 06 , 2015 3:55 PM 


L 


llCTDXFBI) 

__pTD)(FBI); JUPINA, MICHELLE A (RMD)(FSI);[ 


To 
Cc 

LOlllSE M (RM0)(FS1) 

Subject: FW: State Department Emails --FOIA Coordination — SECRET 

Importance: High 


](RMD) (FBI); NEAGLE, 


bS 

hlC 


ClasVif icatiopi : SECRET 

Classified l/By: J23J98T32 

Derived V/om: FBI NSIC, dated 20120629 

Declassi/f \ On : 20401231 


TRANSITORY RECORD 

nzzn \ 

As we discussed, attached is the email for review. 


b6 

b7C 


From ! I RMD) (FBI) 

Se nt: Monday, April 06, 20 15 2:37 PM 
To d Ir CTDVFBn 

Cc: | | (RMD) (FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(F8I) 

Subject: State Department Emails --FOIA Coordination — SECRE T 

Importance: High 



2 


b6 

b7C 


HRC-464 





b6 

b7C 


From: 

Sent: 

To: 

Cc: 

Subject; 

Importance: 

SentinelCaseld: 


IfRMD) (FBI) 



ALL INFORMATION CONTAINEE 

HZRZIN IS UNC LAS5IFIED 

DATE 11™ 0 7-2016 BY J37J35T34 NS I CC 


I I RMD) (FBI) 

I M/gan^gaWA , DriltQ8* 2Qi1i5«.Qr59AMI 
r CTDlfFBI) 
l (RMD) (FBI) 

State Department Emails --FOIA Coordination — UNCLASSIFIED 
High 

TRANSITORY RECORD 


Classification: UNCLASSIFIED 


TRANSITORY RECORD 

I 1 ' b6 

hlC 


Any prognosis on document H-3? 

Sorry I missed your earlier email. They have 55,000 emails— how many we will see is uncertain. 

1=1 


Classification: UNCLASSIFIED 


i 


l 


HRC-465 



ALL INFORMATION CONTAINED 


c 


|(RMD) (FBI) 


HEREIN IS UNCLASSIFIED 

DATE 3Y J37J8ST94 1JSICC 


From: 

Sent: 

To: 

Subject: 


I i RMP) (FBI) 

|il O , cir . sa ? y l f&p, g lK 9 tmi i 5 l8 ' 


f 


RE: State Department Emails --FOIA Coordination — UNCLASSIFIED 


SentinelCaseld: TRANSITORY RECORD 


b6 

b7C 


Classification: UNCLASSIFIED 
TRANSITORY RECORD 

Thankd I certainly understand CTD's focus 


Fronvf 


](CTD)(FBI) 


Se nt : tliM nsda vflA^i l[Q9frioLSt6-'54»A M ffi 


To: 
Subject: 


W 


](RMD) (FBI) 

State Department Emails --FOIA Coordination — UNCLASSIFIED 


b6 

b7C 

b6 

b7C 


Classif ication: UNCLASSIFIED 
TRANSITORY RECORD 


Front office made unexpected edits late yesterday which caused us a delay. l | who did the original work was out 
sick yesterday so we were unable to finish the product by COB. Once he is in this morning this will be his first priority 
and we will hand carry it back to the front office. 

Respectfully, 


From: 

RMD) (FBI) 

Sent: Wednesday. ApT? 

08, 2015 10:59 AM 

To: 

1 

CTD)(FBI) 

(RMD) (FBI) 

Cc: 



Subject: State Department Emails --FOIA Coordination — UNCLASSIFIED 

Importance: High 


Classification: UNCLASSIFIED 
TRANSITORY RECORD 


[ 


Any prognosis on document H-3? 


b6 

hie 


i 


HRC-466 







SentinelCaseld: TRANSITORY RECORD 


Classification: SECRET/ 

Classified By: F48MOTK72 

Derived From: FBI NSlV dated 20120629 

Declassify On: 2040123\ 


TRANSITORY RECORD 

(U)| | 

b7' 

(U) Attached is the e-mail in question with the text CTO thinks should be redacted highlighted in yellow* In the margins 
weVe indicated the pertinent FOiA exemptions, if you have any questions, please let us know. Thanks, 

■ffi 

105739808 - Work 
- CTD Redacti. . 

3?^ iui 



(U) Biessed are they who maintain justice, 
who constantly do what is right 
- Psalm 106:3 


(RMD) (FBI) 


Se nt: Monday* April Q6. 20 15 2:37 PM 
To:| VjCTDJCFBI) 

Cc:| |[RMD) (FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(FBI) 

Subject: State Department Emails -FOIA Coordination — SCCRCT - 


Importance: High 


Classification: SEiSRET 
Classified By: J2309BT32 

i 


b6 

b7C 


HRC-467 


From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 



TRANSITORY RECORD 


Forwarded to State. Thanks!!! 



TRANSITORY RECORD 



Subject: RE: State Department Emails --FOIA Coordination — S ECRET 



(U) Attached is the e-mail in question with the text CTD thinks should be redacted highlighted in yellow. In the margins 
we've indicated the pertinent FOlA exemptions. If you have any questions, please let us know. Thanks. 

!U| « File: C0S739808- Work -CTD Redactions.pdf » 



(U) Blessed ore they who mointoin justice, 


1 


b6 

b7C 


b6 

b7C 


HRC-472 








DECLASSIFIED BY: HSICG J37JB5T34 
OH 1 1 “0 7 “201 £ 

1 1 b7C 


From: 

Sent: 

To: 

Cc: 


Subject: 


ndav 


(CTD)[FBt)i_ 


IrMDJ(FBI) 
Bstea aaiaaeiaw 
__Rctd)7fbi) _ 

|miuim VFFtivf 


b7E 


I 


MICHELLE A (RMD)(FBI); N EAGLE, LOUISE M (RMD)(FBI) 

RE: State Department Emails -FOIA Coordination — S ECRE’E - 


"^ TD ^J^ot(FBI) ; JUPINA, 


Importance: High 

SentinelCaseld: TRANSITORY RECORD 


Classif ication: ''SECRET / 

Classified By: J23 jWt32 

Derived From: FBI Ns^C, dated 20120629 

Declassify On: 2040123'i 


TRANSITORY RECORD 

[ == | 

b7C 

Just received a call from State, They want to argue about the bl portion. We'll need to discuss, are you free at 2:00? I 
suspect they may call AD Steinbach. 

Thanks, 

izn 


From j K RMDHFBI) 

Se nt: Thursday, AprT09 , 2015 11:22 AM 


To: 

j{rTm fFBil 


r 

Cc: 

[(RMD) (FBI); 

(CTD)(FBI)J 

|(CTD)(FBI);[ 


Subject: RE: State Department Emails -FOIA Coordination — S E CRET 


be 

b7C 

b7E 


Classif ication : \SECRET / 

Classified By: J23J^T32 

Derived From: FBIJ^SlC^ dated 20120629 

Declassify On: ^04O1233N\ 

TRANSITORY RECORD 

Forwarded to State. Thanks!!! 


From J l (CTD) (FBI) 


Se nt: Thursday, Apr il 09, 2015 10:35 AM 


To: 

IfRMDl f FBI) 



Cc: 

, (RMD) (FBI)i 

KCTD)(FBI); 

CTD)(FBI); 


i 


b6 

b7C 

b7E 


HRC-473 



J37l785T34 





DECLASSIFIED BY : US ICG 
OH 11-07-2016 


From: 

Sent: 

To: 

Subject: 


I If RMD) (FBI) 

Friday. Mav 22. 201511:39 AM 
I k OGC) (FBI) 

FW: Coordination Review - Segment H-3 — SCCnETZ/NOFOnN 


Importance: High 


SentinelCaseld: TRANSITORY RECORD 


Classification: SECRET/ /NO FQRN 


Classified By: J23J98T3; 

Derived From: FBI NSIO'ti^ted 20130301 
Declassify On: 204Q2231 

TRANSITORY RECORfT 


hS 

hlC 


From 
Sent: 

To:Q 

CC: BONDY, THOMAS M (OGC)(F8I) 

Subject: FW: Coordination Review - Segment H-3 — GCCRCT// N OrOR N 
Importance: High 



(R MD) (FBI) 

WI,WI|WW<a " iaM *^SwFai 


he 

hlC 


Classification: sXcRET//NOFORN 


Classified By: J23J9* 

Derived From: FBI NSl£\ dated 20120629 
Declassify On : 204Q^f2 31 

TRANSITORY RECORf 

1=1 


You're about to get drug into an issue on classification of the Clinton emails. They are contesting CTD's classification 
decision and would like to dis cuss it w ith you. (Forum sh opping I believe .) I'll call you andgive you some info, then 
they've asked if you could call ] ] (last name I think) | | 

1=1 


he 

hlC 


From j |( RMD) (FBI) *6 

Sent: Thursday, April 09, 2015 11:19 AM b7c 

To: JUPINA. MICHELLE A f R MD V FBI) 

Cc: | l fRMDXFBI): NEAGLE, LOUISE M (RMD)(FBI) 

Subject: FW: Coordination Review - Segment H-3 — S EGRET//NO F ORN 
Importance: High 


i 


HRC-474 



RMD) (FBI) 


DECLASSIFIED BY: 1SSICG J37JS5T34 
DH 11-07-201$ 


From: 

Sent: 

To: 

Subject: 

Importance: 

SentinelCaseld: 


L^.^?esTiav^DniF2W 2^^tl£36yR^iltl 

l (CTD) (FBI) 

FW: State Department Emails --FOIA Coordination • 


TRANSITORY RECORD 


Classification :\SECRET 

Classified By: J23J^8^32 

Derived From: FBI/ffsiC^\dated 20120629 

Declassify Oni: -^0401231 

TRANSITORY RECORD 


I've called the State's Legal Advisor 1 s Office a number of times and haven't connected. As they seemed to be wanting to 
resolve this quickly, I'm surprised. I wonder if they gave up on me and went higher. Have you heard anything about 
approaches to your AD? I'm also checking with OGC to see if they went directly to them. 


From:| |(RMD) (FBI) 

Se nt: Monday. April 27 2015 1:16 PM 

To j l (CTD) (FBI) , , . , 

Cc:l KRMD)(FBI):| k CTDKFBIT l t CTD)(FBI);| 

I K OGC) (FBI); JUP1NA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD) (FBI) 

Subject: RE: State Department Emails --FOIA Coordination — -S ECRCT 
Importance: High 


Classification^ SECRET 


Classified By: J23^BT32 

Derived From: FBL/NS^C, dated 20120629 

Declassify On: ZD40123^\ 

TRANSITORY RECORD 


□ 


Just received a call from State. They want to argue about the bl portion. We'll need to discuss, are you free at 2:00? I 
suspect they may call AD Steinbach. 


Thanks, 


HRC-475 




DECLASSIFIED BY: MSICG J37JBBT94 
ON 11“07“2016 




|(RMD) (FBI) 

From: I l (CTD) (FBI) 

Sent: smsa nesfla^>niKaf20 jlStea:9!lSiWil 

To: | l (RMD) (FBI) 

Subject: KE: State Department Emails -FOIA Coordination — OCCRC f - 

SentinelCaseld: TRANSITORY RECORD 


Classification: SECRET 

Classified By: F48M57^2 

Derived From: FBI MSiC, idated 20120629 

Declassify On: 20401231 \ 


TRANSITORY RECORD 

(U) I've not heard anything about approaches to my AD, but I'll have my UC double-check at the 4pm close-out meeting 
with exec management. 

(U) Just as an FYI, I've also not heard anything back yet from the LE6AT. 


b6 

b7C 


b6 

b7C 


From:|_ 


(RMD) (FBI) 


Se nt: Wednesday, April 29. 2015 1:36 PM 
To: l ] (CTP) (FBI) 

Subject: FW: State Department Emails --FOIA Coordination — SECRET 
Importance: High 


b6 

b7C 


Classification : \SECRET / 

Classified By: J23J^T32 

Derived From: FBI/ftfSrS^ dated 20120629 

Declassify On: ^TM0123r\ 

TRANSITORY RECORD 


I've called the State's Legal Advisor's Office a number of times and haven't connected. As they seemed to be wanting to 
resolve this quickly. I'm surprised. I wonder if they gave up on me and went higher. Have you heard anything about 
approaches to your AD? I'm also checking with OGC to see if they went directly to them. 


b6 

b7C 


1 


HRC-476 




CECLASSIflEC BY: HSICG J37J35T94 
OH H-07-2016 






From: 

Sent: 

To: 

Subject: 




L 


IrMD) (FBI) . 

Mg§fetSI5fe?59IBMl 

□KCTD) (FBI) 


RE: State Department Emails --FOIA Coordination — SECRET 


SentinelCaseld: TRANSITORY RECORD 


Classification: SECRET / 

Classified By: J23J^&T32 

Derived From: FBI NS ICY dated 20120629 

Declassify On: 2Q401231\ 


TRANSITORY RECORD 


b6 

b7C 


Thanks! I don't see any urgency at this point. 


From: ! t CTD) (FBI) b 6 

Se nt: Wednesday, A pril 29, 2015 2: 19 PM b7c 

To d ~~H (RMD) (FBI) 

Subject: RE: State Department Emails -FOIA Coordination — 3ECRCT 


Classif icatior 

Classified By: 
Derived From: 
Declassify On: 


TRANSITORY RECORD 


b6 
b7C 

(U) I've not heard anything about approaches to my AD, but I'll have my UC double-check at the 4pm close-out meeting 
with exec management. 

(U) Just as an FYl, I've also not heard anything back yet from the LEGAT. 





From ! I rRMDHFBn b6 

Sent: Wednesday, April 29, 2015 1:36 PM b7C 

To: l I (CTO) (FBI) 

Subject: FW: State Department Emails -FOIA Coordination — SECRET 
Importance: High 


Classification : 


SEC 


:^T 


l 


HRC-477 






DECLASSIFIED BY: NS ICC J37J85T94 
ON ll-D7-20ifi b6 

■ b7C 


From: 

Sent: 

To: 

Subject: 




[^RMD) (FBI) 


RE: State Department Emails --FOIA Coordination — SECRET 


1(RMD) (FBI) 


SentinelCaseld: TRANSITORY RECORD 


Classification: SECRET/ 

Classified By: J23j\sT32 

Derived From: FBI RsXc, dated 20120629 

Declassify On: 204)912:81 


TRANSITORY RECORD 



I believe the first document reviewed was part of this batch-but am not entirely sure. 



b6 

b7C 


State Department Provides New Benghazi Documents To House Panel. Chris Wallace reported on Fox News’ 
Special Report (4/30, 1.53M) thal the State Department’s Benghazi Accountability Review Board “turned over more than 4,000 
pages of documents and notes to the House Select Committee on Benghazi,” Committee Chairman Trey Gowdy said the 
documents “were recently subpoenaed a second time after the initial request two years ago," adding that he “is still waiting for the 
Department to produce other records that have also been requested or subpoenaed.” 

Politico (4/30, French, 1.11M) reports that the documents “were not reviewed by the other half-dozen committees that 
investigated the 2012 attacks.” Gowdy said, “Contrary to those who said all had been asked and answered, the Benghazi Committee 
has shown there is more still for Congress to consider.” The Washington Times (5/1 . Sherfinski, 641K) reports that Democrats “on 
the committee have said a handful of investig.yiofiS.into the attack have already been done and say Republicans are using the 
committee as a way to attack” Hillary Clinton. 

USA Today (5/1. Page, 5.01 M) reports that Gowdy also “says he might be willing to accept assurances under oath from Hillary 
Clinton that she has provided all her relevant emails to the panel — dropping requests for an independent examination of her 
computer server; He told “Capitol Download," “If she were, under some theory, able to say, 'yes, I can promise you under penalty of 
perjury you have every single document you're entitled to,’ that would probably shut off that line of inquiry. If she can, then it will be a 
short conversation.” 


Frotr H I (CTD) (FBI) b6 

Sen t: Wednesday. A pril 29. 2015 2:19 PM b7c 

To: I l (RMD) (FBI) 

Subject: RE: State Department Emails -FOIA Coordination — GCCRET 


Classification : 


:ret 


Classified By: F48M57Kj 
Derived From: FBI N$TC, dieted 


20120629 


l 


HRC-478 






ALL IHFORMMTDW CONTAINED 
HEREIN IS UNCLASSIFIED 

DATE ll-07-201« 3Y J37J85T94 NS ICC- b6 

- b7C 


From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 


I IfRM Dl (FBJ) 

I h CTD) (FBIl l I tCTDMFBn 

JUPINA, MICHELLE A (RMD){FBI); NEAGLE, LOUISE M (RMD){FBI) 
HRC Email — UNCLASSIFIED//F©ye 

TRANSITORY RECORD 


1|RMD) (FBI) 


Classification: UNCLASSIFIED/ / f&tf© 1 
TRANSITORY RECORD 


I I b6 

hlC 

Just a head's up. I got a call fronr | l oD, concerning the classified HRC email. He received a call from 

State asking if we would revisit the issue. I directed him to CTD as the ultimate SME on harm and the classification 
decision. (I did tell him as an OCA I concurred in the markings.) 



Classification: UNCLASSI FIED//TT7UU 


HRC-479 





ALL INFORMATION CONTAINED 




HEREIN IS UNCLASSIFIED 

DATE li-0 7 ~2 0 1 6 BY ,337385134 HSI£ 


From: 

Sent: 

To: 

Cc: 

Subject: 


(£51) 


(RMD)(FBI); 


{RMD) (FBI); 


r~TfRMD)(FBI) 

NEAGLE. LOUISE M (RMD)(FBI) 

RE: TRIM Document : 15/DO/1703 : Letter from Patrick F. Kennedy, Department of State 
(DOS), advising of the receipt of 55.000 pages of e-mails from former Secretary of State 
Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revi 


SentinelCaseld: NON-RECORD 


b6 

b7C 


Classification: UNCLASSIFIED 


Boss just sent an email to 


saying I’ll be the official. 


Original Message- 

From: | ] (RMD)(FBI) 

Sen t: Monday, Hay 18. 2015 2:27 PM 
To: I I (RMD) (FBI); 

Cc: NEAGLE, LOUISE M (RMD) (FBI) 


(RMD) (FBI); 


(RMD) (FBI) 


Subject: RE: TRIM Document : 15/DO/1703 : Letter from Patrick F. Kennedy, Department of State 
(DOS), advising of the receipt of 55.000 pages of e-mails from former Secretary of State 
Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revi 


Classification: UNCLASSIFIED 


b6 

b7C 


No 


Original Message-- — 

From: I 1 (RMD) (FBI) 

Sen t: Monday, May 18 , 2015 2:26 PM 
To: I I (RMD) (FBI); | 

Cc: NEAGLE, LOUISE M (RMD) (FBI) 


]RMD) (FBI); 


(RMD) (FBI) 


Subject: RE: TRIM Document : 15/DO/1703 : Letter from Patrick F. Kennedy, Department of State 
(DOS), advising of the receipt of 55.000 pages of e-mails from former Secretary of State 
Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revi 


Classification: UNCLASSIFIED 


b6 

b7C 


l has anyone suggested to you that our POC will be anyone other than 
Thanks _ 


b6 

b7C 


Original Message 


From: 

Sent: Monday, May 18, 2015 2:04 PM 


(RMD) (FBI) 


To: [ 


(RMD) (FBI); £ 


] (RMD) (FBI); 


(RMD)(FBI) 

Cc: NEAGLE, LOUISE M (RMD) (FBI) 

Subject: FW: TRIM Document : 15/DO/1703 : Letter from Patrick F. Kennedy, Department of State 
(DOS), advising of the receipt of 55.000 pages of e-mails from former Secretary of State 
Hillary Clinton and requesting a senior FBI official to coordinate the FBI’s revi 
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HRC-480 



Classification: UNCLASSIFIED 


Good afternoon, please note the short deadline (tomorrow!!) for response to the Department of 
State . 


Original Message 

From: ExecSec (DO) (FBI) 

Sent: Monday, May 18, 2015 1:55 PM 

To: | | (RMD ) (FBI) ; JUPINA, MIC HELLE A (RMD) (FBI); f 

NEAGLE, LOUISE M ( RMD)(FBI); I I (RMD) (FBI); [ 

I l(RM P) (FBI) 


C^E 


1(OGC) (FBI); [ 


] (0GC)(FBI);[ 


□(RMD) (FBI); 
]( RMD) (FBI); 


] (OGC) 


] (DO)(OGA) ; JOHNSON, GORDON B. (DO) (FBI); PERKINS, KEVIN L. (DO) 

^J(DO)(FBI);[ 


] (DO) (FBI);C 


(FBI); 

(FBI); 

(DO) (FBI GIULIANO, MARK F (DO) (FBI); I I (CTD)(FBI);| I (DO) 

(FBI); | 1 (DO)(OGA) 

Subject: TRIM Document : 15/DO/1703 : Letter from Patrick F. Kennedy, Department of State 
(DOS), advising of the receipt of 55.000 pages of e-mails from former Secretary of State 
Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revie -- 


Classification: UNCLASSIFIED 


NOTE TO RMD: This TRIM document has a short deadline of 5/19/15. 

ACTION OFFICE: RMD 

The above division, designated as the action office, is assigned the attached Director's 
Office correspondence for preparation of a response over the signature of YOUR APPROPRIATE 
DIVISION OFFICIAL by the DUE DATE indicated below. The original will be forwarded to the 
action office's point of contact. INFORMATION ONLY electronic copies are being sent to OGC, 
Chief of Staff, Associate Deputy Director, Deputy Director and Special Counsel to the 
Director. 


IMPORTANT NOTE: you. represent an FBI Field Division and are receiving this e-mail, you 

are being provided a copy of correspondence which has come to the attention of the Director, 
or other FBI executive Ypu are not being tasked with any action in this regard by the FBI’s 
Office of the Executive Secretariat. You are being provided a courtesy copy only. 

I 

Responses handled through other means, such as via telephone contact, e-mails, etc,, should 
be forwarded to the ExecSec via e-mail, and must include the Trim DO# and sufficient relevant 
data, such as date, contact, and disposition, to allow ExecSec to close the pending action. 

If this matter needs to be reassigned to another entity, the FBI ExecSec should be advised 
immediately (within 2 days of e-mail receipt). The ExecSec will need to know to whom the 
request should be reassigned, together with a point of contact (if known), and the original 
correspondence will need to be returned to ExecSec, Room 6147, 

ACTION OFFICE INSTRUCTIONS: (Failure to comply with the following instructions will delay 
the closing of pending action and will result in the correspondence appearing on the overdue 
report) 

A, Response Preparation : 


2 


bS 

hlC 


HRC-481 




1. Prepare the -following: 

-One UNDATED letterhead copy, 

-An envelope or mailing label, 

-A blocked yellow UNDATED file copy, attaching the original incoming correspondence to the 
yellow file copy, and a copy of the incoming to each designated "courtesy copy" (cc), as 
appropriate. The yellow copy mail room block must be checked and initialed, and the TRIM 
number noted on the yellow (can be handwritten). 

2 . At a minimum, the copy count must include the following copy designation: 

Trim XX/DO/XXXX 

1 - (Your confirmation white copy, if desired) 

B. Routing of the Final Response Package: 


1. Route your final response package to the FBI ExecSec, Room 6147. The FBI ExecSec will 
forward the completed package to the mailroom for delivery. 

< TRIM Record Information > 


Record Number : 15/DO/1703 

Date Due : Tuesday, May 19, 2015 

Addressee : AD-Records Management (Addressee) 

Current Action : PREPARE RESPONSE PER INSTRUCTIONS (Responsibility of: Executive 

Secretariat, Due S/19/2015 at 1:43 PM (14 hours, 55 minutes)) 

All Contacts : AD-Records Management (Addressee) 

Office of General Counsel (Other) 

Chief of Staff (Other) 

Associate Deputy Director (Other) 

Deputy Director (Other) 

Special Counsel to the Director (Other) 

Access DB or Workflow : 

From : KENNEDY, PATRICK F. 

Constituent : 

Title (Free Text Part) : Letter from Patrick F. Kennedy, Department of State (DOS), 

advising of the receipt of 55.000 pages of e-mails from former Secretary of State Hillary 
Clinton and requesting a senior FBI official to coordinate the FBI's review with their FOIA 
team. 

Notes : RMD advised during electronic routing that there is a short deadline for this 

TRIM record. 


'Monday, May 18, 2015 at 1:44:50 PM (GMT-04-.00) 


iae Communication : Thursday, May 14, 2015 

lelateo Records : 
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Classification: UNCLASSIFIED 

Classification: UNCLASSIFIED 

Classification: UNCLASSIFIED 
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Classification: UNCLASSIFIED 


Classification: UNCLASSIFIED 





From: 

Sent: 

To: 

Subject: 


IRMD) .(FBI). 

JUPINA, MICHELLE A (RMD)(FBI) 

HRC Emails — UNCLASSIFIED//FOUO 


Importance: High 

SentinelCaseld: TRANSITORY RECORD 


FBI INFO 

CLASSIFIED BY: H3ICG J37J85T34 
REASON! : 1.4 <C) 

DECLASSIFY OK: 12-31-2C4C 
DATE: 11-07-2016 


Classification: UNCLASS I FIED//F0U0 
TRANSITORY RECORD 


Michelle, 


Just returned from the meeting at State hosted by USS Kennedy concerning HRC emails. After discussing the logistics of 
any cons ultations regardin g the 55,000 pages in order to meet a court-ordered Jan 2016 deadline. Secretary Kennedy 


requester^ 


DoJ/OIP, and me to stay behind to discuss the FBI determination of classified material in an 
initial batch of 296 emails dealing with Benghazi. These emails were processed in response to a request by the House 
Select Committee on Benghazi, they were processed using FOIA guidelines. 


State Department referred the document to us for our review. I passed the email to CTD who reviewed and marked the 
document with FBI equities. Included was one line marked with the with classification "SECRET." Attached is the email 
in question with markings. As an OCA, this marking was entirely consistent with the thousands of FBI documents I've 
reviewed over the years. State OLC contacted me initially objecting to the classification. Later Secretary Kennedy 
contact edl 


in 10 D, who then contacted me. I've notified CTD Exec Sec in each instance of the contact. 


The redaction lists "interference with foreign relations" as the rationale. The crux of States argument is they know 
better what will impact foreign relations and there is no longer a government in place. The more appropriate rationale 
is sources and methods. While the email does not name the particular official, this might be deduced and, given the 
threat of violence in this region, any surmise could be fatal for whoever cooperated with us. State will say no one will 
know if it is redacted, but that is not how classification works. 


This all said, CTD is ultimate decider as to the level of harm contained in the information. I told Secretary Kennedy this 
and he said he would be calling AD Steinbach. 


□ 


"Here is our response. I recommend you go ahead and classify the forwarding email to us in the future in case we 
determine there is classified information. This marking was approved by the CTD fron t office. The first bracket starts 

The bl marking 


with, "Apparently...", the second bracket starts with, "The A/RSO...", the third bracketT 
is SECRET//NOFORN," L 


■ffi 

:05739808 - Work 
' CTD RedactL. 


I 
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ALL INFORMATION ODH'T AIMED 
HEREIN IS UNCLASSIFIED 

CATE 11-07~201« EY J37J85T34 NSICC fa g 
■in. — i. b7C 


From: 

Sent: 

To: 


Cc: 


Subject: 


STEI NBACH. MICHAEL B. fCTDl (FBI) 

GIA CALONE. JOHN (p O)fFBH: JLIPINA, MICHELLE A (RMD)(FBlf 
fFBHl |(CTD) fF BH *1 

IfnVnwFRnj — . ](CTD) (fbi)[_ 


]rmdj 


(CTD) {FBI) J 

State email FOIA — UNCLASSIFIED 


|CTD)(FBI) 




SentinelCaseld: TRANSITORY RECORD 


Classification: UNCLASSIFIED 


TRANSITORY RECORD 

All 

I just spo ke to Pat Kennedy at DoS reference a State.gov email dated November 18, 2014 07:01PM from | | b6 

| l and in which the FBI was requested to review a pending FOIA request. b7c 

I advised him independent and objective reviews by both RMD and CTD previously determined two portions needed to 
be redacted based on exemption (b)(1) - "specifically authorized under criteria established by an Executive order to be 
kept secret in the interest of national defense or foreign policy." We spoke earlier today and in the conversation 
requested that, as the Assistant Director CTD, I review the content and revise the determination and redact based on 
exemption (b)(7)(D) only- "could reasonably be expected to disclose the identity of confidential source, including a 
State, local, or foreign agency or authority..." 

After discussions with RMD and CTD today, l explained to Mr Kennedy to only exempt for (b)(7)(D) was not appropriate 
as the information in the two portions in question was classified at the Secret/NOFORN level and exemption (b)(1) was 
needed in addition to exemption (b)(7)(D). Therefore, I would not change the original determination made by the FBI. 

Michael B, Steinbach 
Assistant Director 
Counterterrorism Division 

b6 
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Classification: UNCLASSIFIED 
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ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-07-2Q16 3Y J37J85T94 NS ICC 


he 

hlC 



][RMD) (FBI) 


From: 

Sent: 

To: 

Subject: 


JUPINA, MICHELLE A (RMD)(FBI) 
Thursday, May 2 1 . 2015 4:16 PM 
| kRMD) (FBI) 

FW: State email FOlA— UNCLASSIFIED 


SentinelCaseld: TRANSITORY RECORD 


Classification: UNCLASSIFIED 
TRANSITORY RECORD 


From: JUPINA, MICHELLE A (RMD)(FBI) 

Sent: ljh^ l i3day^[yla^4iy'2oi5falfelPf?iB 

To: RYBICKI, JAMES E (DOj(OGA); GIULIANO, MARK F {DO) (FBI); GIACALONE, JOHN (DO)(FBI); STEINBACH, MICHAEL 
B. (CTD) (FBI); BAKER, JAMES A (OGC)(FBI) 

Subject: RE: State email FOIA — UNCLASSIFIED 


Classification: UNCLASSIFIED 
TRANSITORY RECORD 

lisan OCA and he can classify the information, unless CTD would prefer to classify it. 
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From: RYBICKI. JAME S E (DO)(OGA) 

Sent: ilih^da^Ma ^M^Q/lStfl :Q9 i RM—a 

To: GIULIANO, MARK F (DO) (FBI); GIACALONE, JOHN (DO)(FBI); STEINBACH, MICHAEL B. (CTD) (FBI); JUPINA, 
MICHELLE A (RMD)(FBI); BAKER, JAMES A (OGQ(FBI) 

Subject: FW: State email FOIA — UNCLASSIFIED 


Classification: UNCLASSIFIED 


TRANSITORY RECORD 

State Department COS Jonathan Finer called this afternoon reference this matter. He provided the background on the 
review process, stated that he was not attempting change the AD's classification decision, and said that he just wanted 
to make sure that FBI leadership was aware of the decision and the procedural process and media attention it would 
likely trigger. 

I spoke to AD Steinbach who provided the background on the decision and l relayed back to the State Department that 
leadership is aware of the review process and decision. Mr. Finer asked whether it would be possible for the FBI to 
classify the information (as opposed to the State Department classifying on behalf of the FBI). I told him that I would 
inquire but would defer to the classification and FOIA experts. 

Jim 



HRC-486 




ALL I ]■! FQRL£ft.T I DH CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-07-201S BY J37J85T34 NS ICG 


he 

hlC 


ft 

TfRMD) (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 


^’d^^a^22»2Q ^^5lBf a? 

GIACALONE, JOHN (DO)(FBI) 

JUPINA, MICHELLE A (RMD)(FBI) 

RE: State email FOIA — UNCLASSIFIED 

TRANSITORY RECORD 


Classification: UNCLASSIFIED 


TRANSITO RY REC ORD 

Thank you sirj | . b6 

b7C 


From: _GIA C AL ONE, JOHN (DOKFB 1 ) . ^ 

To: lUWN^MfHS^MRMDJtFBI); 

Cc: GIUUANO, MARK F (DO) (FBI) 

Subject: RE: State email FOIA — UNCLASSIFIED 


RMD) (FBI) 


b6 

b7C 


Classification: UNCLASSIFIED 
TRANSITORY RECORD 

Michelle ] | - Great job by you and your team on addressing the review of the DoS emails. Your thorough analysis b6 

and recommendation were spot on. Well done - thanks - John L7 i 


From: JUPINA, MICHELLE A (RMD)(FBI) 

Sent: Thursday, May 21, 2015 4:16 PM 

To: RYBICKI, JAMES E (DO)(OGA); GIUUANO, MARK F (DO) (FBI); GIACALONE, JOHN (DO)(FBI); STEINBACH, MICHAEL 
B. (CTD) (FBI); BAKER, JAMES A (OGC){FBI) 

Subject: RE: State email FOIA — UNCLASSIFIED 


Classification: UNCLASSIFIED 


TRANSITORY' RECORD 

|is an OCA and he can classify the information, unless CTD would prefer to classify it b6 

b7C 


From: RYBICKI, JAMES E (DO)(OGA) 

Sent: Thursday, May 21, 2015 4:09 PM 

To: GIUUANO, MARK F (DO) (FBI); GIACALONE, JOHN (DO)(FBI); STEINBACH, MICHAEL B. (CTD) (FBI); JUPINA, 
MICHELLE A ( RMD)(FBI); BAKER, JAMES A (OGC)(FBI) 

Subject: FW: State email FOIA — UNCLASSIFIED 


l 
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ALL FBI IHFGRzIATIDH COHTAIHED 

HEREIN IS UNCLASSIFIED 

DATE 10-3 1 -2 D 1 6 BY J37JE5T34 MSICC 


b6 

b7C 


From: 

Sent: 

To: 

Subject: 



i cp > < fb| i 


MacDougall, Mark l 

Monday, August 1 0. 2015 4:19 PM 


bryan Magnano 


] (CD) (FBI) 


Agenq 


b6 

b7C 


I am writing following our telephone conversation of earlier today regarding our client, Bryan 
Pagliano. In response to your inquiry, we are not prepared to have Mr. Pagliano participate in an 
interview with the FBI - particularly in the absence of any explanation as to the focus or scope of your 
prospective questions. Please ask the Department of Justice lawyer responsible for this investigation 
to contact me if further discussions are needed. Also, please convey to any other DOJ or FBI 
personnel involved in your investigation that Mr. Pagilano is represented by counsel and that all 
further inquiries should be directed to our law firm. My full contact information is provided below. 


Thanks. 


Mark MacDougall 


Mark J. MacDougall 

AKIN GUMP STRAUSS HAUER & FELD llp 


1333 New Hampshire Avenue, N.W. | Washington, DC 20036-1564 | USA | Direct: [ 
Fax: +1 202.887.4288 || 


akinoump.com | Bjjj 


]| Internal [ 


b6 
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The information contained in this e-mail message is intended only for the personal and confidential use of the 
recipient(s) named above. If you have received this communication in error, please notify us immediately by e- 
mail, and delete the original message. 


b6 




ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 


CLASSIFIED EY: NSICC 


J37JS5T54 


REASON : 1.4 (C! 

DEC LAS S I T Y ON : 12-31- 

DATE ; 10 -31-2 01^ 


3040 


f D- ] 087 (Rev. 5-8-10J 


S^R^T 


T/ /HOFORH 

FEDERAL BUREAU OF INVESTIGATION 



O FFI CIAL H eCPHO 

A! **'<? Isv * 

:.r". !>J Ffl‘ .'iVnni^M 


Collected item Log 

* s \ 1 

Event Title: 

Approved By : | | 


Date: 08/12/2015 


bl 

b3 

b7E 


b6 

b7C 


Drafted 

Case ID 


By: 

# 


,v 



(S//Wt)\ I 

MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER 


[SIM) 


bl 

b3 

b7E 



Classify 


Full Investigation Initiated: 07/10/2015 

Collected From: (U) Platte River Networ ks/Equinex 
800 Secaucus Rd 
Secaucus, New Jersey 07094 


Receipt Given?: No 

Holding Office: WASHINGTON FIELD 


Details: No Details Provided 


Item Type Description 

IB Digital ■ [J) Dell Poweredge 2900, Gray Color, S/N G842PC1 

Collected On: 08/12 /2015 

Seizing Indivi dual: | | 

Collected By: | | 

Location Area: NA 

Specific Location: NA 

Device Type : Computer 

Serial Number : G842PC1 

Number of Devices Collected : 1 
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This document contains neither recommendations nor conclusions of the FBJ It is the property ofthc FBI and is loaned to vour agency; it and its 
contents are not to be distributed outside your agency. 


HRC -497 




(Si 

Title : 

Re: f" 1 




T//MOFOBM 


J 08712/201 



bl 

b3 

b7E 


♦ ♦ 


StelffiT/ / W OFOR M 


2 
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FD-302a (Rev. 10^6-95) 



ALL IHFQR&sAT IDN CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 1 o -31-201 € BY J37JS5T34 NSICC 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07/3 1/2015 


On the morning of July 31, 2015, Federal Bureau of Investigation (FBI) Special A gent (SA)C 
Received a voicemail on her desk telephone from a woman identifying herself as 


from[ || |advised she represented the clients at P latte River Networks who were 

recently provided a copy of a preservation letter from the FBI. I Ista ted on the voicemail that she 

advised her clients to ''follow the instructions on the letter to thief'. I then stated that if the FBI had 
any further questions regarding the letter to contact her at telephon 


S A telephoned later the same morning at 


her voicemail and appreciated the contact. 


to advise she received 


b6 

b7C 


hS 

blC 


investigation on 07/31/2015 at Denver. Colorado 

File# I Date dictated N/A 


BySA l I 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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HRC-5Q0 
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U.S. Department of Justice 


Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


Date : 

August 11, 2015 

To: 

John Kerry 

Secretary of State 

U.S. Department of State 

From: 

Charles H. Kable 

Section Chief 
Counterespionage Section 
Counterintelligence Division 



ALL INFORMATION CONTAINS! 

HZKEIN IS UNCLASSIFIED 

DATS 10-31-2016 BY J37JS5T34 NSICCj 



Subject: Request for 


On July 6, 2015, the FBI received a Section 811(c) Referral from the 
Inspector General of the Intelligence Community regarding the potential 
compromise of classified information. Pursuant to this referral, FBI 
respectfully reanestsi I 


1 . 

2 . 

3 . 

4 . 

5 . 

6 . 

7. 

8 . 

9 . 

10 , 
11 
12 , 

13 , 

14 , 
15 


b7E 


b6 

b7C 

b7E 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your 
agency; it and its contents are not to be distributed outside your agency. 


HRC-502 



You are also requested not to disclose the existence of this request , other than as necessary to comply 
with this request, as the FBI's investigation may be jeopardized by this type of disclosure. 

If you hav e any questions rega rding this request , please direct all inquiries to Special Agent 

kvho can be reached all I 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your 
agency; it and its contents are not to be distributed outside your agency. 


HRC-503 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


ALL INFORMATION CONTAINED 
3E3EIM IS UNCLASSIFIED 
DATE 11-07-201E BY J37J85T34 



August 12, 2015 

b7E 


Re: Request for Preservation of Records 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all records and other evidence in your possession regarding the domain 
account @clmtonemail.com, pending further legal process. 

You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
of this request to the subscriber or any other person, other than. as necessary to comply with this 
request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also 
requested not to close the account of the subscriber, unless requested to do so by the subscriber. 
If compliance with this request may result in a permanent or temporary termination of service 
to the accounts described below , or otherwise alert the subscriber or user of these accounts as 
to your actions to preserve the referen ced files and records, please contact Special Agent 

as soon as possible and before taking any such actions. 


This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. The contents of any communication or file stored by or for the account and any 
associated accounts, and any information associated with those communications 
or files, such as the source and destination email addresses or IP addresses. 

C. All records and other evidence relating to the subscriber^), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 


be 

b7C 


HRC-507 



identity, billing records, information about the length of service and the types of 
services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other 
form; and 

D. All connection logs and records of user activity for the requested account, 
including: 

1. Connection date and time; 

. 2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer'volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

E. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 

If you have any question s regarding this reque st please direct a ll inquiries to 

Iwho can be reached at| 


b6 
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Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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HRC-510 

1 * 



U.S. Department of Justice 


Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-07-2016 BY J37J85T34 NS ICG 

August 12, 2015 

b7E 


Re: Request for Preservation of Records 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all records and other evidence in your possession regarding the domain 
account @clintonemail.com, pending further legal process. 

You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
of this request to the subscriber or any other person, other than as necessary to comply with this 
request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also 
requested not to close the account of the subscriber, unless requested to do so by the subscriber. 

If compliance with this request may result in a permanent or temporary termination of service 
to the accounts described below, or otherwise alert the subscriber or user of these accounts as 
to your actions to preserve the referen ced files and records, please contact Special Agent 

as soon as possible and before taking any such actions. b6 

b7C 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested account. 

B. The contents of any communication or file stored by or for the account and any 
associated accounts, and any information associated with those communications 
or files, such as the source and destination email addresses or IP addresses. 

C. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 
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identity, billing records, information about the length of service and the types of 
services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other 
form; and 

D. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

E. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


Special Agent 


If yon have any questions regarding this reque st, please direct a ll inquiries to 

| who can be reached at l 


be 

b7C 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 


_j_ CATE 11-07-2015 EY .737JS5T34 NS ICG 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/07/2015 


On August 7 , 2015 , 

Records Management Division provided the enclosed 
communications, classified SECRET/ /NOFORN , 


for the FBI ' s 
internal FBI 
referencing three ( 3 ) 


documents passed to the FBI by the State Department on or about April 
29, 2015. Insofar as the State Department had identified FBI equities 
contained in these documents, they were sent to the FBI for 
classification review* 


b6 

b7C 


The first email, dated September 16, 2015 was found to contain no 
classified information and released in full without redactions. The 
second email , dated October 17 and 18 , 2012 was redacted and released 
in part using the B7 (A) and B7.{C) FOIA exemptions. The third email, 
dated October 3 , 2012 , was redacted and released in part based on the 
B1 FOIA exemption insofar as it contained non-FBI classified 
information . 


The enclosure to this record is classified SECRET/ /NOFORN. 


Investigation on 08/07/201 5 at Washington. DC. 

File # J I Date dictated N/A 
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DECLASSIFIED BY: MS ICC 
OH 11-07-2016 


J37JS5T34 
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From: 

Sent: 

To: 

Subject: 

SentinelCaseld: 


(RMD) {FBI) 


Thursday. August 06. 2015 3:23 PM 
| ^ tNR(FBI): [ 


Documents#2 — OCORCTflNO F OWN 


Classificatio 

Classified By 
Derived From: 
Declassify On^ r . 

TRANSITORY RECORD 

Please see attached. 



0130301 


](LA)(FBI} 


■ffi 

Doc. pdf 


he 

hlC 


Classification: /NO TORN 
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RMD) (FBI 


DtCLASSIFIED BY: NSICG J37JS5T94 
OH 11-07-2016 
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From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 


Classification: SECRET/O/NOFORN 

Classified By: J23J9W32 

Derived From: FBI NS-rC, dated 20120629 

Declassify On: 204Qd2ji 

TRANSITORY RECORD 

| b6 

b7C 

Attached are three new emails from State. The review on these three documents has not been finalized by State, so the 
markings reflect the status at this time. Thanks! 


hRMD) (FBI) 

Wednesday .f^pr i 11^9^ 2011^5^4 Q;PM 

--3 (CTD) (FBI) 

l fC TD)(FBI):l 

tOGC){FBI)J 

(FBI); NEAGLE, LOUISE M (RMD)(FBt) 
HRC emails, FOIA case F-201 5-04841 — ! 


TRANSITORY RECORD 


“□(RMD) (FBI)I 
](CTD)(FBI); JUPlR 


MICHELLE A (RMD) 


18 H ■B 

C05739708 pdf C05739758.pdf C05739635.pdf 


□ 
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From: 

Sent: 

To: 

Cc: 

Subject: 

SentinelCaseld: 



DECLASSIFIED EY 

_ OH 11-07-2016 

l(RMD) (FBI) 

I I fRMP) (FBI) 

Thursday. April 30. 20 15 8:32 AM 

— J(CTD) (FBI) . 

I fCTDKFBD l I fRMP) (FBI) 

RE: HRC emails. FOIAcase F-2015-04841 — 3EC R ET//N0F0 R N 

TRANSITORY RECORD 
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Classification: SECRET/ /NO FORN 

Classified By: J23J9RT32 

Derived From: FBI N^TCy dated 20120629 

Declassify On: 204fJl23l\ 

TRANSITORY RECORD 

Yes, and l understand internally at State there was some who agreed with our marking. 


FromC 


] (CTO) {FBI) 


Se nt: Wednesday, A pril 29, 2015 6:07 PM 


To 

Cc:| 


l(RMD) (FBI) 
^(CTD)(FBI);[ 


](RMD) (FBI}£ 


](OGC) (FBI); 


(CTD)(FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(FBI) 
Subject: RE: HRC emails, FOIA case F-2015-04841 — SCCRET//NO F ORN 
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Classification: SECRET //NOFORN 

Classified By: F48M57 k!?2 

Derived From: FBI NS^C, sated 20120629 

Declassify On: 2040a231 'v 


TRANSITORY RECORD 

iuCD 

(U) Thanks, we'll take a look at these and get a response back. In glancing at the third e-maill notice it's been marked by 
DOS as containing classified information. That might in part explain why they've backed off some of their early 
resistance to use invoking the bl exemption. 

(uCD 
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From£ 


](RMD) (FBI) 


Sent: Wednesday, April 29, 2015 5:40 PM 
J(CTD) (FBI) 


To: 

Cc: 


TctdxfbhjC 


]{RMD) (FBI);[ 


](CTD)(FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(FBI) 
Subject: HRC emails, FOIA case F-2015-04841 — 5ECRET//NOrOI\N 


](OGC) (FBI); 
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From: 

Sent: 

To: 

Cc: 


Subject: 

SentinelCaseld: 


[ 


](RMD) (FBI) 


Wednesday, May 06 2015 12:56 PM 
(CTD) (FBI| 


— RC'piIEEll 

J(OGC) (FBI);[ 


DECLASSIFIED BY: NS ICC- J37JS5T94 
ON 11“07~201'S 


be 

b7C 


(FBI); NEAGLE, LOUISE M (RMD)(FBI) 

RE: HRC emails, FOIA case F-201 5-04841 

TRANSITORY RECORD 


~ l(RMD) (FBI); | , 

JCTDJ(FBI); JUPINA. MICHELLE A (RMD) 


GECRCT// N Or ORN 


Classification: SECRET //NOFORN 

Classified By: J23J91&TJ 
Derived From: FBI NSlCy dated 20120629 
Declassify On: 1 2040^31 s 

TRANSITORY RECORI 

IZZI 

Do you have the status? I need to appease State, 

Thanks 

IZZI 


b 6 
blC 


From: I I RMD) (FBI) bS 

Sent: Wednesday, April 29, 2015 5:40 PM b7c 

TO^— Z^ZZlCTD) (FBI) , , 

. I | fCTD)(FBI); l I (RMD) (FBI) J 1 (OGC) (FBI); 

I l (CTD)fFBI); JUPINA, MICHELLE A (RMD) (FBI); NEAGLE, LOUISE M (RMD)(FBI) 

Subject: HRC emails, FOIA case F-2015-04841 — SECRET//NOFOR N 


Classification: SECRET// NO FORN 

Classified By: J23jWp32 

Derived From: FBI Nsio^, dated 20120629 

Declassify On: 204(1I23I\ 


TRANSITORY RECORD 

I I 

b7C 

Attached are three new emails from State. The review on these three documents has not been finalized by State, so the 
m a rki ngs reflect the status at thistime. Thanks* 


« File: C05739708.pdf » « File: COS7397S8.pdf » « File: C05739635.pdf » 
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DECLASSIFIED BY: NSICG 
G1T 11-07 -2 D 1 6 


331C!3ST$* 


I I (RMD) (FBI) 


From: 

Sent: 

To: 

Cc: 


Subject: 


(RMD) (FBI) 


Friday, May 08. 2015 1 1 :26 AM 
(CTD) (FBI 
DMFBIn 




(CT 


(FBI); NEAGLE. LOUISE M (RMD){FBI) 

RE: HRC emails. FOIAcase F-201 5-04841 


JcTD)(FbT); JUPINA, MICHELLE A (RMD) 


]{RMD) (FBI);[ 


OEORETffNOrORN 


be 

b7C 


SentinelCaseld: TRANSITORY RECORD 


Classification 

Classified By: 
Derived From: 
Declassify On: 



TRANSITORY RECORD 


20120629 


Thank you very much, hope you're feeling better. 


From£ 


](CTD) (FBI) 


Sent: Friday, May 08, 2015 10:02 AM 
To H l(RM D) (FBI) 

Cc:| I (CTDXFBI);[“ 


](RMD) (FBI);[ 


CTD)(FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(FBI) 
Subject: RE: HRC emails, FOIA case F-2015-04841 — GECRCT//Nor ORN 


](OGC) (FBI); 


be 

b7C 


Classification: SECRET //NO FORN 

Classified By: F 48 MMK 72 

Derived From: FBI/NSliSy, dated 20120629 

Declassify On: ^Ef 40123 l\ 

TRANSITORY RECORD 

tU) l I 

(U) Sorry for the delay in getting back to you. I've been out sick the last couple days. 

(U) CTD is fine with the redactions which DOS recommends and has no requests for further redactions. 

M I , 


he 

hlC 


(U) Blessed are r hey who maintain justice. 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



July 27, 2015 

Custodian of Records 
Platte River Networks 
5700 Washington Street 
Denver, CO 80216 

Re: Request for Preservation of Records 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all records and other evidence in your possession regarding the domain 
account @clin tonemail.com, pending further legal process. 

You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request until receipt of a legal court order. You are also requested not to disclose the existence 
of this request to the subscriber or any other person, other than as necessary to comply with this 
request, as the FBI’s investigation may be jeopardized by this type of disclosure. You are also 
requested not to close the account of the subscriber, unless requested to do so by the subscriber. 
If compliance with this request may result in a permanent or temporary termination of service 
to the accounts described below , or otherwise alert the subscriber or user of these accounts as 
to your actions to preserve the referenced files and records , please contact Special Agent 
I I as soon as possible and before taking any such actions. 

This preservation request applies to the following records and evidence: 

A. 


B. 


C. 


All stored electronic communications and other files reflecting communications to 
or from the requested account. 

The contents of any communication or file stored by or for the account and any 
associated accounts, and any information associated with those communications 
or files, such as the source and destination emaT ddres‘ ;s or IF " :s. 

All records and other evidence relating to the si .>criber(s\ cufiomer^,. account 
holder(s), or other entity(ies) associated with the reuMieu j^^lAyiing, 
without limitation, subscriber names, user names, so9^ names ^^^^fldentities, 
mailing addresses, residential addresses, busine s ^dresses, e-i^^^^Hsses and 
other contact information, telephone numbers o: oiler J 
identity, billing records, information about the length ■ 
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• • 

services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other 
form; and 

D. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; . 

5 . User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

E. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any question s regarding this reques t, please direct a ll inquiries to 


Special Agent 


who can be reached at 


be 

b7C 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 


Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


ALL IHFDaMAT ICtl CONTAINED 
HEREIN 13 UNCLASSIFIED 



July 31, 2015 

Joseph P. Clancy 
Director 

United States Secret Service 
950 H Street., NW 
Washington, D.C. 20223 


Re: Request for Preservation of Records 

Dear Director Clancy: 

This letter is a formal request for the preservation of all records and other evidence in 
your possession, or in the possession of Hillary Clinton, former Secretary of State, regarding the 
domain account @clintonemail.com, pending further legal process. 

You are hereby requested to preserve the records described below currently in your 
possession, or in the possession of Hillary Clinton, including records stored on backup media, in 
a form that includes the complete record, and records that may come into your possession from 
the date of acknowledgment of this request until receipt of a legal court order. You are also 
requested not to disclose the existence of this request, other than as necessary to comply with this 
request, as the FBI's investigation may be jeopardized by this type of disclosure. 

This preservation request applies to the following records and evidence: 

A. All stored electronic communications and other files reflecting communications to 
or from the requested domain account. 

B. All servers, computers, thumbdrives, hard drives, smartphones, or any other 
digital storage devices in your possession or in the possession of your client, 
which may contain communications to or from the requested domain account. 

C. All business records and other evidence relating to the establishment of the 
domain referenced above, including subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or 
identity, billing records, information about the length of service and the types of 
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services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other 
form; and 

D. All connection logs and records of user activity for the requested account, 
including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g.. telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

E. Any other business records and other evidence relating to the requested account. 
Such records and other evidence include, without limitation, correspondence and 
other records of contact by any person or entity about the above-referenced 
account, the content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


Special Agent 


If you have any questions regarding this reque st, please direct all inquiries to 


Kvho can be reached an 


b6 

b7C 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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CATE 1 1 “ 07“201 ‘S BY J37JS5T34 N5ICG 


United States Senate 

COMMITTEE ON The- JUDICIARY 
WASHINGTON, DC 20%}G~&r!§ 


^v.-V-i 1.. S-ViiS. i.'.-^r G?:\W. L 

f^fiM i :^ir ,j, i <'>^r G .: : ;,-,V jv-for 


August 5, 2015 

VIA ELECTRONIC TRANSMISSION 


The Honorable James B. Comey, Jr. 

Director 

Federal Bureau of Investigation 
935 Pennsylvania Avenue, NW 
Washington, D.C. 20535 

Dear Mr. Comey: 

The Judiciary Committee has learned that the Office of Inspector General for the 
Department of State (State OIG) opened an investigation involving potential criminal conduct by 
Ms. Huma Abedin while she worked for the Department of State under then -Secretary Clinton. 
Specifically, the investigation examined the circumstances of Ms. Abedin’s work arrangements, 
leave status, and conversion from a full-time Department of State employee to a Special 
Government Employee (SGE) and Senior Advisor to former Secretary Clinton. 

During the course of its investigation into this matter, the Committee has learned that the 
State OIG transmitted a letter, notice, or other similar communication (“letter”) to the FBI in 
October 2013 placing it on notice that State OIG’s investigation was no longer a preliminary 
matter but a full-fledged criminal investigation into Ms. Abedin. However, there have been 
public denials that the information provided to the Committee is accurate. 1 In order for the 
Committee to assess the veracity of the information provided in this matter, please provide a 
copy of the October 2013 letter from State OIG by no later August 12, 201 5. If no such letter 
exists, please advise the Committee immediately. 

If you have any questions, contact Josh Flynn-Brown of my Committee Staff at (202) 224- 
5225. Thank you for your cooperation. 


Sincerely, 

Charles E. Grassley 
Chairman 

Committee on the Judiciary 


1 S.A. Miller, “Hillary Clinton aide Huma Abedin emerges as potential liability for 20 16 bid,” WASHINGTON Times (August 4, 
2015), Accessible at http://www,washingtontinics,com/ncws/20l 5/aug/4/hillary-clinton-aidc-huma-abcdin-cmergcs-as-potcnt/ 
(“’There is no criminal investigation, and there never has been. To say otherwise is patently false and grossly irresponsible,’ [Ms, 
Abedin’s attorney, Karen L. Dunn] said.”) 
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All INFORtATIGN CONTAINED 
HEREIN IS UNCLASSIFIED 

"I" DATE 11-07-201'S 3Y J37J85T94 1JS ICC 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07/3 1/2015 


On 07/31/2015, at approximately 12:45 p.m., Special Agentl 
letter addressed to Joseph P. Clancy, Director, U.S. Secret Service to[ 
Secret Service. 


served a pres ervation 

lu.s. 


be 

b7C 


The preservation letter wa s served at U.S. Secret Service's office loc ated at 950 H, Street, NW, 
Washington. DC 20223 J brovided his cont act information as phone: 


b6 

b7C 


Investigation on 07/31/2015 
File # 


. at. 


Washington, DC 



By SA 


This document contains neither recommendations nor ( 
and its contents are not to be distributed outside your agency. 


>ns of th 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


Date : 
To: 


From: 


August 4, 2015 

Steve A. Linick 
Inspector General 
Department of State 

Charles H. Kable 
Section Chief 
Counterespionage Section 
Counterintelligence Division 


ALL I HFORHA T I Dl l CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 11-07-201'S BY 237J85T3-J HSICG 

1 



Subject: Request for copies of Preserved 


b7E 


On July 6, 2015, the FBI received a Section 811(c) Referral from the 
Inspector General of the Intelligence Community regarding the potential 
compromise of classif ied information. Pursuant to this referral, FBI 
respectfully requests [ Ifor 

the following 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your 
agency; it and its contents are not to be distributed outside your agency. 


HRC-545 
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20 

21 

22 , 

23, 


You are also requested not to disclose the existence of this request , other than as necessary to comply 
with this request, as the FBI's investigation may be jeopardized by this type of disclosure. 

If you ha ve any questions rega rding this reques t, please direct all inquiries to Special Agent 

who can be reached at b 6 

1 I 1 b7C 


Sincerely, 



Charles H.KablelV 
Section Chief 

Counterintelligence Division 


♦ ♦ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your 
agency; it and its contents are not to be distributed outside your agency. 
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To : 
Re : 


CD-4 From: 

(U) 


CD-4 
Date : 


08/05/2015 


FBI INFO. 

CLASSIFIED BY: NS ICG J37J85T34 
REASON: 1.4 (C) 

DECLASSIFY OH: 12-31-2040 
DATE: 11-03-2016 


b3 

b7E 


Precedence : ROUT I NE 


Date: 08/05/2015 


To: CD-4, Counterespionage Section 

From: CD-4 f Counterespionage Section 


Contact: A/ASC 


Approved By: 


5 


Drafted By: 



Case ID #: (U) | 


hr 



Title: (S//NF) 


Synopsis: ( U / / FOUO ) To document meeting with the US Secret 

Service on 07/28/2015. 

C las s i f ied^y^C^2W5 3B3 0 

Derived Fropt^^BI NSIC dated 20130301 

Declassify On: Z0401231 


b6 

b7C 


bl 

b3 

b7E 


Enclosure (s) : (U/ /FOUO ) One original copy of notes taken by 

Counterespionage Section (CD-4) Section Chief Charles Kabl e IV; 
one or iginal copy of notes taken by CD-4 A/ASC f I 


| on e original busine ss card from US Secret Service (USSS) 

Inspector | | 


Details: (U/ /F0U0 ) On 06/28/2015, CD-4 SC Kable and A/ASC 

met with the USSS Office of Inspection s. Acting Special Agent in 
Charge, Inspector l I and D eputy Special Agent 

in Charge, Inspector l I at USSS Headquarters, 

950 H St. NW, Washington, DC 20223. 


W f I and I 

regarding their obligation to not 
investigation and voluntarily 
acknowledgement forms. CD-4 requested 
assistance in obtaining USSS information 
location, operation, and USSS 
personal e-mail 


1 were admonished 
further discuss the FBI's 
execute d sensiti ve case briefing 

and [ 


related t o thp 
involvement with the 
network/server . CD-4 also requested — their 


iS ! 


b6 

b7C 


b6 

b7C 
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b3 
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To: 
Re : 


CD-4 

(U) 




From: 


T//H OFORM 


CD-4 

Date: 08/05/2015 


b3 

b7E 


IS? 


assistance in identifying appropriate USS S personnel to be 


interviewed as part of the 


Investigation . 


s request, but 


FBI 
management 
mission 


acknowledged that he understood the 

advised that he would need to confer with his 
given that the request dealt with the USSS protectee 
advised he would only generally inform his 
type of information the FBI was seeking and 
to his ma nagement the s pecific subject or 
l investiaation. I I left the 

confer with unidentified USSS managers and indicated 
return to the meeting room with a response. 


management of the 
would not iden tify 
details of the l 
meeting to 
he would 

, '^- t (h>^F) Approximately 20 minutes later, [ 

returned to-^the^meeting ro om and ad vised that he had conferred 


with his management chain. 




advised that his management 


told him that any FBI request for information or assistance 
related to this matter would need to come via written request 
from the Department of Justice to the Department of Homeland 
Securi ty, which would then forward the request to the USSS , When 
asked, 


I re 
e - 


refused to iden tify the spe cific USSS m anager (s) 


to whom he spoke - CD- 4 advised[ 


] and 


J that 


the only two USSS officials read-in to the 

investigation r they were not permitted to oj.ji.uj j — m e c au 
of the FBI's investigation with anyone - 1 andf 


indicated they understood their obligation to protect the 
investigation. 


as 

ence 


bl 

b3 

b7E 


bl 

b3 

b6 

b7C 


bl 

b3 

b6 

b7C 
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HEREIN IS UNCLASSIFIED 
-1- DATE 1 1 “0 7“ 2 □ 1 6 EY J37JB5TS4 NSICG 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/14/2015 


O n 08/14/2015. Special Agent 
records to 


provided (1) Disc containing 30, 542 email 

]Office of the Inspector General of the Intelligence Community. 


be 

bic 


Jwas also provided a letter signed on 08/13/2015 from Randall C. Coleman, Assistant Director 


to L Charles McCullough III which outlined the guidelines for the release of the Disc. 


Investigation on 08/14/2015 

File# I I 


at Washington, DC 

Date dictated N/A 


BySA^ 


This document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Col looted Hem Log 
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Event Title: 


Date: 08/14/2015 


bl 

b3 

b7E 


Approved By : 


be 
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Drafted By: 
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MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


bl 

b3 

b7E 


Reason: 1 JHc) 
Derive^<From: Multiple 
Sources 

Declassify Oh: 20401231 
Full Investigation Initiated: 07/10/2015 


CLASSIFIED BY: HSICC J37J85T94 
REASON: 1.4 (C> 

DEG LASSIFY ON: 12-31-2040 
DATE: 11-07-2016 

all information contained 

HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 


Collected From: (U) KATHERINE TURNER, ESQ 
WILLIAMS & CONNOLLY, LLP 
725 12TH STREET, NW 
WASHINGTON, District Of Columbia 

t 

Receipt Given?: No 


Holding Office: WASHINGTON FIELD 


Details: No Details Provided 

Item Type Description 

IB General (U) BOX OF EMAIL PAPER DOCUMENTS. 

BOX 2 

Collected On: 08/06 /2015 

Seizing Indivi dual: I ~ 

Collected By: | 

Location Area: NA 
Specific Location: NA 
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This document contains neither recommendations nor conclusions of the FBI It is the property of the FBI and is loaned to your agency; it and its 
contents arc not to be distributed outside your agency. 
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08/14/2015 


IB General 


IB General 


IB General 


IB General 


IB General 


(U) BOX OF EMAIL PAPER DOCUMENTS. 
BOX 4 


Collected On: 08/06/2015 

i 

Seizing Indivi dual ; 
Collected By: 

Location Area: 


NA 


Specific Location: 


NA 


(U) BOX OF EMAIL PAPER DOCUMENTS ♦ 
BOX 5 

Collected On: 08/06 /2015 

Seizing Indivi dual: I 

Collected By: | 

Location Area: NA 
Specific Location: NA 


(U) BOX OF EMAIL PAPER DOCUMENTS. 
BOX 7 

Collected On: 08/06 /2015 

Seizing Indivi dual: I 

Collected By: 

Location Area: NA 
Specific Location: NA 

(U) BOX OF EMAIL PAPER DOCUMENTS. 
BOX 9 

Collected On: 08/06 /2015 

Seizing Indivi dual: | 

Collected By: | [ 

Location Area: NA 
Specific Location: NA 


(U) BOX OF EMAIL PAPER DOCUMENTS. 
BOX 10 


Collected On: 08/06/2015 


Collected By: 
Location Area: 


dual : 





NA 


Specific Location: 


NA 


b6 

b7C 


b6 

b7C 


bS 

b7C 


b6 

b7C 


b6 

b7C 



iS'1 

Title: 
Re: I 


stepK^T 


T/ /MOPOHH 


08/14/2015 


bl 

b3 

b7E 
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Location Area: NA 
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Collected On: 08/0 6/2015 
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Collected By: 
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Specific Location: NA 

IB General (U) BOX OF EMAIL PAPER DOCUMENTS. 

BOX 2 0 

Collected On: 08/ 06 /2015 

Seizing Indivi dual : | 
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Specific Location: NA 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/03/201 5 


On August 3, 2015, 


Records 


Management Division, Records Information and Dissemination Section, 
Winchester, Virginia provided the enclosed internal email 
communications referencing the FBI's classification of a Nov ember 18 , 
2012 State Department email. The enclosure was provided by I I in 

support of statements made during a July 30, 2 015 FBI interview and 

documents items discussed at that time. The enclosure has an overall 
classification of /NOFORN . 
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b7C 


Investigation on Q8/03/20I5 
File# J 




at 


Washington, D,C T 

Date dictated N/A 


b3 

b7E 


By SAl 


This document contains neither recommendations nor conclusions of the FBI. 
and its contents are not to be distributed outside your agency. 
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It is the property of the FBI and is loaned to your agency; ii 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 07/31/2015 


On July 31 , 2015 


receptionist at Williams and 


Connelly LLP, accepted a preservation letter on behalf of Kathleen 
Turner to preserve records and electronic media related to the 
©clintonemail.com email server* 
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Investigation on 07/31/2015 at Washington, DC 
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File # 


Date dictated N/A 


By SAl 
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This document contains neither recommendations nor conclusions of the FBI . It is the property of the FBI and is loaned to your agency; ij 
and its contents are not to be distributed outside your agency, 
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FEDERAL BUREAU OF INVESTIGATION 


Collected Item Log 


Event Title: 


X 


-Si 


Date: 08/14/2015 


bl 

b3 

b7E 


Approved By : 


Drafted 


Case ID 



(S//WF) | I 

MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER 


(SIM) 


b6 

b7C 


bl 

b3 

b7E 


Full Investigation Initiated: 07/10/2015 



Collected From: .(U) Katherine Turner, Esq 
williams & Connolly, LLP 
725 12th Street, NW 
Washington, District Of Columbia 

Receipt Given? : No 

Holding Office: WASHINGTON FIELD 


Details : 


No Details Provided 


Item Type Description 

IB General (U) Box of Paper Documents - Email - Box 19 

Collected On: 08/0 6/2015 

Seizing Indivi dual: T | 

Collected By: 

Location Area: . NA 
Specific Location: Na 
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This document contains neither recommendations nor conclusions of the FBI It is the property of the FBI and is loaned to your agency, it and its 
contents are not to be distributed outside your agency. 
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IB General 


IB General 


IB General 


(U) Box of Paper Documents - Email - Box Box 3 

Collected On: 08/06 /2015 

Seizing Indivi dual : | 

Collected By: | | 

Location Area : NA 
Specific Location: NA 


(U) Box of Paper Documents - Email 
Collected On: 08/06/2015 
Seizing Indivi dual : 

Collected By: 

Location Area : 


Box 18 


Specific Location : 


NA 


(U) Box of Paper Documents - Email - Box 22 

Collected On: 08/06 /2015 

Seizing Indivi dual : | ~| 

Collected By: , 

Location Area: NA 
Specif ic Location : NA 


(U) Box of Paper Documents - Email - Box 14 

Collected On: 08/06 /2015 

Seizing Indivi dual : \ | 

Collected By: 

Location Area: NA 
Specific Location: NA 


(U) Box of Paper Documents - Email - Box 21 

Collected On: 08/06 /2015 

Seizing Indivi dual : | 1 

Collected By: | 

Location Area: NA 
Specific Location: NA 


[U) Box of Paper Documents - Email - Box 1 
Collected On: 08/06/2015 
Serzing Indivi dual : | 

Collected By: 

Location Area : NA 
Specific Location: NA 
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Collected On: 08/06 /2015 

Seizing Indivi dual : I ~ 
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(U) Box of Paper Documents - Email - Box 15 
Collected On: 08/06/2015 
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Collected By: 
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Si 


bl 
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IB General (U) Box of Paper Documents - Email - Box 13 

Collected On: 03/06 /2015 

Seizing Indivi dual : | | 

Collected By: 

Location Area : NA 
Specific Location: NA 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/13/2015 


On August 12, 2015 , 


of Platte River Networks, 


5700 Washington St, Denver, CO 80216, met with Agents of the FBI at 
the Equinix facility located at 800 Secaucus Road, Secaucus, NJ 07094, 
to turn over to the FBI a computer server used to host the email 
system for former Secretary of State Hillary Clinton's 
©clint onemail . com Internet domain. 


At approximately 4:00PM, 


met Agents and one CART 


Forensic Examiner at the parking lot of Equinix (the collocation 
facility where the server was physically located and operated from) 
and transferred one (1) Dell Poweredge server to the FBI's possession 
described in detail below and on the enclosed FD-941, Consent to 
Search Computers, and FD-597, Receipt for Property. 

Item 1: Dell Poweredge 2900, gray color, S/N G842PC1 


signed the enclosed FD-941, Consent 


Prior to departing, | 
to Search Computers, and FD-597, Receipt for Prope rty. The original 
was kept by the FBI and copies were made by 


for his records . 
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Subsequent to the FBI's collection of the above, Item 1 was 
entered into evidence, and given a IB number by the Washington Field 
Office, and then transported to the FBI's Forensic Analysis Unit in 
Quant ico, Virginia for storage and evaluation. Copies of the intake 
sheets and FD-1004 are enclosed with this communication. 


Investigation on 08/12/2015 


at 


File# 




Secaucus. N J 


Date dictated N/A 
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FEDERAL BUREAU OF INVESTIGATION 

EVIDENCE DATA-LOADING FORM 


CLASSIFIED BY: NSI CC J76J1STSD 
REASON: 1.4 'C> 

DECLASSIFY" ON: 12-31-2040 
DATE: 11-03-2016 

ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
JtfHERE SHOWN OTHERWISE 


Separate forms are mandatory for evidence seized on different dates, at different locations, by different individuals, for different 
types of evidence. 


Type of Evidence being submitted: 

D General Evidence D Firearms 

□ Valuable Evidence □ Weapons 

□ Evidence Purchase Money □ Other 

D Drug Evidence D FGJ 

13 CART 


Warning - special handling 

□ Body Fluids Q Other 

□ Whole Blood ______ 

□ HAZMAT 

O Refrigeration □ Enviro/ 


Case ID: 


Title and Character of Case: 





;si 

Person Acouiring Evidence: 


Date Acquired: 


Time Acquired: ; 

S %A 


$/ IT,/ tots' 




bl 

b3 

b6 

b7C 

b7E 


Source from which evidence acquired: 
[Person's name/job title/company/address] 


fZli/te goo ygA , AJ o7&j L i 


— 

Anticipated Disposition: 

l- : 

Forfeiture Potential: 

□'Yes □,Nq 

■ ^Federal Taxpayer Information: 

□ Yes □ No 

Sealed By: [printed name] 

* 

Witnessed-Byi-, [printed name] 

Estimated Dollar Value: 

Total Drug Package Weight: 


Complete Description (Please^Pri ht) 




ilk 

nit- 

m?r- 






This form is to be used as a data-loading form only, 
entered into Evidence Data Base. 


h(JT is to discard this form when the information contained herein has been 
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REASON : 1.4 <C> 

DECLASSIFY ON: 12-31-2040 


DATE: 11-05-2016 


Details 


Item: 1B3 


C ""' * * „ „ , rnlor s/N G842PC1 (Only Paperwork 

Description: (U) Dell Poweredge 290 , ra 

Submitted] 


b7E 


b3 

b7E 


Collected On: 08/12/2 015 04:10 PM EST SpeCja! Handling: 

Receipt Item #: None Hazardous Materials: 

CATS ID #: None 

FBI Seizure #: None Abandonment #: 


CATS Abandonment#: None 


None 

None 

None 


ALL IN FORMAT ION CONTAINED 
HEREIN IS UNCLAS SIFTED EXCEPT 
WHERE SHOWN OTHERWISE 


Digital Information 

Type: Computer 

Serial Number: G842PC1 

Batteries Charged: No 

Number Collected: 1 

Collected by CART: NO 


Discovery Location 


\ ' 

^ Others Agency: 

b6 

Seizing Individual^ 
Specific; 

X 1 - 

NA 

1 Others: None 


b7C 


None 


Anticipated Disposition 

None 


on None 


Storage Information 
Holding Office: 


WASHINGTON 


field 


Finalized By: 



Location: E1167159 - ECRl , MAIN 


Last Inventory: None 

EVIDENCE control center (B112) WFC HQ 


Barcode#; £5490158 


Chain of Custody 
Shipping t Transfer tog 
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History 


Acquisition Event Details 
Acquisition Event: 

Collected From: 


X 


(Si 


(U) Platte River Networks/Equine 
800 Secaucus Rd 
Secaucus, New Jersey, 


07094 


x 


Receipt Given: No 

Holding Office: WASHINGTON FIELD 


Evidence Log: I 

Serial 28 
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of 1 


Case ID: 


UNITED STATES DEPARTMENT OF JUSTICE 

FEDERAL BUREAU OF INVESTIGATION 

Rece ipt for Property 


On (date) 08/12/2015 


item (s) listed below were: 
E3 Collected/Seized 
n Received From 

□ Returned To 

□ Released To 


b3 

b7E 


(Name) p ^ atte River Networks 

(Street Address) Equinix: 800 Secaucus Road 

(City) Secaucus* NJ 07094 


Description of Item (s): 


Ml 









ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 11“ 03-201 6 BY J76J1ST8D NS ICG 



CONSENT TO SEARCH COMPUTER(S) 


1, 


( f\g /vo//f> J , have been asked by Special Agents of the 

Federal Bureau of Investigation (FBI) 

any electronic and/or optical data sto 

described below: 

Dai ^ oasts' 

i to permit a complete search by the FBI or its designees of any and all computers, 

rage and/or retrieval system or medium, and any related computer peripherals, 

he- 2*1 GO <^a-. c/H 

CPU Make, Model & Serial Number (if Available) ' 

Storage or Retrieval Media, Computer Peripherals 





b6 

b7C 


and located at 800 Secaucus Road t Secaucus NJ Q7Q94 _____ i , which l own, possess 

control, and/or have access to, for any evidence of a crime or other violation of the law. The required passwords, logins, 

and/or specific directions for computer entry are as follows: ___________________ ■ 

1 have been advised of my right to refuse to consent to this search, and 1 give permission for this search, freely 
and voluntarily, and not as the result of threats or promises of any kind* 

I authorize those Agents to take any evidence discovered during this search, together with the medium in/on which 


August 12, 2015 

Date 

August 12, 2015 

Date 


1 


— 


— 




Special Agent 
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ie*TT 


Printed Full Name of Witness 


Secaucus, NJ 

Location 


HRC-568 



b6 

b7C 



HRC-569 % 



ALL FBI I HFORMA.T I OK CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 1 1“ 0 0 1 6 BY J76J1BT80 NS ICG 


MUN JOHNSON, WISCONSIN, CHAIRMAN 
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ihomas n, carper, Delaware 
fit AlHIS-McCASKILL Missouri 
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COMMITTEE ON 

HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 
WASHINGTON, DC 20510-6250 

August 17, 2015 


The Honorable James B> Comey 
Director 

Federal Bureau of Investigation 
935 Pennsylvania Avenue, NW 
Washington, D.C, 20535 

Dear Director Comey: 

I write to inquire about recent reports that the Federal Bureau of Investigation (FBI) has 
taken possession of a personal email server and a thumb drive containing 30,000 emails sent or 
received by former Secretary of State Hillary Clinton that may include classified information. 
According to the Inspector General for the Intelligence Community (IC IG), the emails contained 
on the thumb drive and transmitted on the personal server include national security information 
collaterally classified as high as Top Secret and subject to Sensitive Compartmented Information 
control systems, which are reserved for the country’s most sensitive intelligence 2 As the FBI 
begins to examine the thumb drive and server, I seek to understand what steps you have taken to 
review the material and to evaluate the safeguards surrounding the classified information. 

On March 12, 2015, 1 joined Chairman Bob Corker and Chairman Richard Burr in asking 
the Inspector General of the State Department to examine whether State Department employees 
sent or received classified information in an insecure manner. 3 We asked that the State 
Department IG coordinate with the IC IG in this review. 4 On March 18,2015,1 wrote separately 
to the State Department IG to inquire whether Secretary Clinton’s personal emails included any 
classified information. 5 On July 23, 2015, the IC IG notified Congress that its limited sampling 
of a portion of Secretary Clinton’s emails had revealed the presence of classified information. 

The IC IG referred the matter to the FBI. 7 . 


1 See Michael S. Schmidt, Hillary Clinton directs aides to give email server and thumb drive to Justice Department , 
N.Y. TIMES, Aug. 1 1, 2015; Tom Hamburger &, Karen Tumulty, Hillary Clinton 's e-mail server turned over to FBI, 
Wash. Post, Aug. 1 2, 20 15 . 

1 Memorandum for Sen. Richard Burr et al. from I. Charles McCullough, III, Update Classified Material on Personal 
Electronic Storage Devices (Aug. 1 1, 2015). 

3 See Letter from Senator Bob Corker et al., to U.S. Dep’t of State, Office of Inspector Gen. (Mar. 12, 20 1 5). 

* Id. 

s Letter from Senator Ron Johnson, S. Comm, on Homeland Sec. & Gov’t Affairs, to Steve A. Linick, U.S. Dep’t of 
State Office of Inspector Gen. (Mar. 1 8, 20 1 5). 

6 Memorandum for Sen. Richard Burr et al. from I. Charles McCullough, III, Update to 1C IG support to State 
Department, IG (July 23, 2015). The 1C IG and State Department IG later clarified that the “emails contained 
classified information when they were generated and, according to IC classification officials, that information 
remains classified today.” I. Charles McCullough, III, & Steve Linick, Statement from the Inspectors General of the 
Intelligence Community and the Department of State Regarding the Review of Former Secretary Clinton’s Emails 
(July 24, 2015). 

7 Memorandum, supra note 6. 
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On August 11, 2015, the IC IG notified Congress that Secretary Clinton’s emails 
included “information classified up to ‘TOP SECRET//SI//TK//NOFORN.’” 8 The same day, the 
New York Times reported that Secretary Clinton surrendered the email server and thumb drive 
containing the emails to the FBI, including at least two emails containing Top Secret 
information. 9 Reports have also suggested that data may have been deleted from the server prior 
to its transfer to the FBI, but that back-up servers may exist and that deleted information on the 
server may be recoverable. 10 These reports raise questions about the steps taken to retrieve, 
preserve, and protect the classified information, and whether additional unsecured copies of 
classified information currently exist. 

The sensitive nature of the information on Secretary Clinton’s personal email system and 
server — classified up to Top SecretZ/Sensitive Compartmented Information— means that its 
release or dissemination to unauthorized individuals could cause “exceptionally grave damage to 
national security” if proper steps are not taken to ensure its safeguarding. 11 I am also deeply 
concerned by recent reports that classified information in Secretary Clinton’s email may exist 
outside of the federal government’s possession. Accordingly, I ask that you provide the 
following information: 

1 . When and how did the FBI first become aware of the potential existence of classified 
information contained in Secretary Clinton’s personal email? 

2. How many FBI agents and employees have been assigned to investigate matters relating 
to the presence of classified information in Secretary Clinton’s personal email? Please 
also identify the FBI component entities involved in this matter. 

3. When does the FBI expect to complete its examination of Secretary Clinton’s personal 
email server? 

4. Is the FBI evaluating the extent to which deleted material on Secretary Clinton’s personal 
email server is recoverable? 


* Memorandum for Sen. Richard Burr et al. from I. Charles McCullough, III, Update to IC IG support to State 
Department IG (Aug. 1 1, 2015), available at http://www.grassley.semte.gOv/siles/defauit//iles/judiciary/upload/ 
Classifted%20docs%2C%20G8-il-15%2C%20IClG%2GCN%20-%20Update%2Qon%20Classifwd% 
20MateriaIs%20oti%20Personal%20thumb%20drive.%20Clinton%20server.pdf. 

9 Schmidt, supra note 1. 

10 ld. \ Chris Strohm & Del Quentin Wilber, FBI said to examine whether Hillary Clinton e-mail was backed up, 
BLOOMBERG, Aug. 13, 2015; Phillip Bump, Could Hillary Clinton 's deleted emails be recovered? Maybe. , WASH. 
POST, Aug. 12, 2015. For example, the National Security Agency and Central Security Service, which are charged 
with securing information systems containing classified information, require sanitization of media that stored 
classified information through degaussing or physical destruction. Erasure, even overwriting all data on a drive with 
multiple passes, is not sufficient. National Security Agency Central Security Service, NS A/CSS Policy Manual 9- 1 2 
(Dec. 1 5, 20 14); see also Defense Security Service, Dep’t of Defense, Industrial Security Letter 2007-0 1 (Oct. 1 1 , 
2007) (“Effective immediately, DSS will no longer approve overwriting procedures for the sanitization or 
downgrading (e.g. release to lower level classified information controls) of IS storage devices (e.g., hard drives) 
used for classified processing.”). 

1 1 See Classification of official information, 1 8 C.F.R. § 3a. 1 1 . 
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5. Is the FBI evaluating the extent to which Secretary Clinton’s personal email server may 
have been compromised by an unauthorized entity? 

6. Is the FBI conducting a digital forensic analysis of Secretary Clinton’s personal email 
server? 

7. What steps is the FBI taking to ensure that all copies of classified material contained in 
Secretary Clinton’s emails are appropriately secured in the federal government’s 
possession? 

8. Has the FBI seized all servers or other devices used to back-up Secretary Clinton’s 
personal email server? 

9. Has the FBI seized all copies of the thumb drive containing Secretary Clinton’s personal 
email? 

1 0. Is the FBI currently aware of the existence of any digital or hardcopy media outside of 
the possession of the federal government that could include classified information 
contained in Secretary Clinton’s emails? 

11 . Is the FBI examining or auditing the physical security of the thumb drive and email 
server implemented by Secretary Clinton and/or her agents or representatives prior to the 
time that the FBI seized the materials? 

12. Is the FBI storing the thumb drive and email server seized from Secretary Clinton in a 
sensitive compartmented information facility? 

13. Do all FBI personnel with access to the thumb drive and email server seized from 
Secretary Clinton have appropriate security clearances? 

I ask that you provide responses to the questions above as soon as possible but no later 
than 5:00 p.m. on August 31, 2015. In addition, as the material may be relevant to ongoing 
congressional reviews of this matter, I ask that you take all appropriate steps to preserve the data 
contained on the thumb drive and email server in, the FBI’s possession. 

The Committee on Homeland Security and Governmental Affairs is authorized by Rule 
XXV of the Standing Rules of the Senate to investigate “the efficiency, economy, and 
effectiveness of all agencies and departments of the Government.” 12 Additionally, S. Res. 73 
(114th Congress) authorizes the Committee to examine “the efficiency and economy of 
operations of all branches and functions of the Government with particular reference to (i) the 


12 S. Rule XXV(k); see also S. Res. 445, 108th Cong. (2004). 
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effectiveness of present national security methods, staffing, and processes ” t3 For purposes 

of this request, please refer to the definitions and instructions in the enclosure. 

If you have any que stions about this request, please ask your staff to contac j 

| of the Committee staff at (202) 224-475 1 . Thank you for your 
attention to this important matter. 


cc: 


The Honorable Thomas R. Carper 
Ranking Member 



b6 

b7C 


Enclosure 


13 S. Res. 73 g 12, 1 14th Cong. (2015). 


HRC-573 



y 

PD- 1 004 

Rev. 4-7-2015 


♦ 




FEDERAL BUREAU OF INVE 

EVIDENCE CHAIN OF CUSTODY 


ALL mraPMATTON contained 
HEREIN IS UNC LASS IF IEC 
CATE 11-03-2015 BY i 75 JISTSD 

igation 


Evidence Type: [J General □ Drugs □ Hreams/Weapon 

Kl Digital D Valuables D Hrearms/Uther 

Special Handling Instructions 

Initial Receipt 

Date and 
Time 

□ HAZMAT □ Latent* O I-tiJ 

LJ Req. Charging [] f reeze Q Refrigerate 

1 1 Hioha/ard 

n fjihcr 

Signature of Seizing Individu 

f\*i J) r" 

Printed Name/Agency: 


Reason: Initial Collection 

jf f JG sW*' 

Collected By 

Agency: 


Relinquished Custody 

Date and 
Time 

Accepted i 

Custody 


Date aud 
Time 

Signal ur 

a i&dh 

< 

hrv^ 

Signature; 




*liths 

2-To m 

Printed Name /Agency] 

SI™* 

Printed Na 

me/Ag£iH?3 


Reason: ~f\ T° OTE> 


Reason: ^ c~**~*^ 

Q 1 t) 

Relinquished Custody 

Date and 
Time 

Accepted Custody ^ 

Date and 
Time 

Signature: 


Signature. 


Printed Name/Agency: 

Printed Name/Agency: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature; 


Signature; 


Prinled Name/ Agency: 

Printed Name/Agency: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 

1 Time 

Signature: 


Signature; 


Printed Name/Agency; 

Printed Name/Agency: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

— ■ — ■ — — 

Accepted Custody 

Date and 
Time 

Signature; ^ 


Signature: 


Printed Name/ Agency; 

Printed Name/Agency: 

Reason; 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signalure: 


Signature; 


Printed Name/Agency: 



Printed Name/Agency: 

Reason: 


Reason; 


Hrearm Certification by (PM/SWAT) / Explosive Material Certification by (SAB I): 

A IP Trace Perm Completed: Q 

Printed Name: 

NC'IC: □ 

Signature: 

Dale: 



I B: ^ ^ Barcode; £ 5v*ion$- 


NS ICC 


b6 

b7C 


b6 

b7C 


b3 

b7E 


HRC-577 




b6 

b7C 



HRC-578 


FD-302a (Rev. 10-6-95) 


ALL INTORJ'L^T IQN CQMTAIHED 

HEREIN IS TJUCLASSIs'IED 

DATS ii-0S“2D16 EY J76J1BTS0 MS ICG 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/24/2015 

On August 21 , 2015, the enclosed Request for Rec ords and 

Preserva tions Requests were delivered electronically to the 

and a confirmation of receipt was acknowledged by 


1 


Investigation on 08/21/2015 


at 


Washington. D.C. 
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This document contains neither recommendations nor conclusions of the FBL It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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HEREIN IS UNCLASSIFIED 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



Date : 
To: 


From : 


August 21, 2015 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


b7E 


Subject: Preservation of Records; Request for Records j 

The Federal Bureau of Investigation (FBI) formally requ ests th at, 
pursuant to Title 18, United States Code, Section 2703 (f ) , | ' | take 
any steps necessary to preserve all electronic and transactional 
records associated with @clintonemail . com email accounts contained on 


This preservation request applijes to all 


stored 

electronic records, files, and other evidence relating to 
communications to and from the @clintonemail .com ej-mail address]. 

On July 6, 2015, the FBI received a Section 811(c) Referral from 
the Inspector General of the Intelligence Community regarding a 
potential compromise of classified in formation.! Pursuant to this 
referral, the FBI respectfully requests 


cause a comprehensive search to be conduc ted of all holdings,: files 


documents, and materials in the 


possession, including back- 


up computer drives, for electronic mail communications to or from 
©clintonemail . com accounts. Due to the nature of the i FBI's 
investigation, we request this search be conducted without undue 
delay and within 30 days of receipt of this letter. Should responsive 
records be obtained, this Bureau requests an electronic copy of all 
non-privileged materials be provided forthwith while a corresponding 
classification review of those records is conducted. The FBI requests 
the results of the classification review be provided to this] Bureau 

banners 


when complete. In addition, the FBI seeks a copy 


ONCLASS I FIED / /-P©TTCT 

This document contains neither recommendations nor conclusions of the FBI. jit is 
the property of the FBI and is loaned to your agency; it and[ 
to be distributed outside your agency. 


of computer 


its contents are not 


HRC-580 


b7E 


b7E 



UNCLASSIFIED/ /FOW 


Icomputer systems on which relevant electronic 


from jany 
communicat ions are found . 

i 

You are requested not to disclose the existence of this inquiry, 
other than as necessary for compliance, insofar as doing so may 
jeopardize the confidential nature of the FBI's investigation. 

If you have any question s regarding this request, please d irect 
all inquiries to Special Agent 


Sincerely, 


b7E 


b6 

b7C 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


♦♦ 


UNCLASSIFIED/ /TON© 

i ! 

This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBi| and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


ALL FBI INTDRHATICH CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-05-1 01 S BY J78J18T8D 113 ICG 



Date : 
To: 


From: 


August 21, 2015 



Counterintelligence Division 


b7E 


Subject: Preservation of Records,- Request for Records 


The Federal Bureau of Investigation (FBI) formally requests that, 


pursuant to Title 18, United States Code, Section 2703(f), you take 
any steps necessary to preserve all electronic and transactional 
reco rds associat ed with (Sclintonemail .com email accounts contained on 

systems. This preservation request applies to all 

electronic records, files, and other evidence relating to 


your 
stored 

communications to and from the Oclintonemail . com e;-mail address. 


b7E 


On July 6, 2015, the FBI received a Section 811(c) Referral from 
the Inspector General of the intelligence Community regarding a 
potential compromise of classified information] Pursuant to this 
referral , the FBI respectfully requests the 


cause a comprehensive search to be conducted of all holdings, 


possession, including 
mail communications to or 
the nature of the FBI's 


conducted without undue 
i 


files, documents, and materials in the 
back-up computer drives, for electronic 
from ©clintonemail . com accounts. Due to 
investigation, we request this search be 
delay and within 30 days of receipt of this letter. Should responsive 
records be obtained, this Bureau requests ah electronic copy of all 
non-privileged materials be provided forthwith while a corresponding 
classification review of those records is conducted. The FBI requests 

unclassified/ /p©ee- 

This document contains neither recommendations nor conclusions of the FBI . It is 
the property of the FBI and is loaned to your agency; it and[ 
to be distributed outside your agency. 


its contents are not 


b7E 
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the results of the I classification review be provided to this Bureau 
when compl ete . In addition, the FBI seeks a copy of computer banners 
from any 


computer systems on which relevant electronic b7E 


communications are found. 


You are requested not to disclose the existence of this inquiry, 
other than as necessary for compliance, insofar as doing so may 
jeopardize the confidential nature of the FBI's investigation. 

If you have any question s regarding this request, please d irect 

all inquiries to Special Agent b6 

l 1 b7C 

i 

J Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


♦ ♦ 
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This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI j and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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Date: August 19, 2015 


To: 


From: Charles H. Kable 

Section Chief 

Counterintelligence Division 


b7E 


Subject: Preservation of Records,- Request for Recprds 


The Federal Bureau of Investigation (FBI) formally requests that, 
pursuant to Title 18, United States Code, Section 2703(f), you take 
any steps necessary to preserve all electronic and transactional 
records associated with ©clixvtoneinail .com email accounts contained on 
your systems. This preservation request applies to all 
stored electronic records, files, and other evidence relating to 
communications to and from the Oclintonemail .com e-mail address. 


b7E 


On July 6, 2015, the FBI received a Section 811(c) Referral from 
the inspector General of the Intelligence Community regarding a 
potential compromise of classified informat ion.; Pursuant to this 
referral, the FBI respectfully requests the I I 
cause a comprehensive search to b e conducted of all holdings, files. 


documents, and materials in the 


possession, including 


back-up computer drives, for electronic mail communications to or 
from Oclintonemail. com accounts. Due to the nature of the FBI's 
investigation, we request this search be conducted without undue 
delay and within 30 days of receipt of this letter. Should responsive 
records be obtained, this Bureau requests an electronic copy of all 
non- privileged materials be provided ’forthwithj while a parallel 
classification review of the records is conducted concomitantly. The 
FBI requests the results of the classification review be provided to 
this Bureau when complete. In addition, the .FBI seeks a copy of 

unclassified // fees i 

This document contains neither recommendations nor conclusions of the FBI * It is 
the property of the FBI and is loaned to your agency; it andj its contents are not 
to be distributed outside your agency. 
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computer banners from any 


computer systems on which relevant b7E 


electronic communications are found. 


You are requested not to disclose the existence of this inquiry, 
other than as necessary for compliance, insofar as doing so may 
jeopardize the confidential nature of the FBI's investigation. 

If you have any question s regarding this request, please d irect 
all inquiries to Special Agent I 


b6 

b7C 


Sincerely, 



Charles h. Kable IV 
Section Chief 

Counterintelligence Division 


♦♦ 


UNCLASSIFIED/ / FOUO 


J 

This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI j and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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To: 

Re: 


CD-4 From: 

(U) I 


CD-4 

Date: 07/24/2015 


pBI Il'Ii'U 

CLASSIFIED BY: 1-tSIC 
REASON: 1.4 <C) 


DECLASSIFY OH: 12-31-2040 
DATE: 11-03-2016 


b3 
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Date: 08/04/2015 


Precedence: ROUT INE 

To: CD-4, Counterespionage Section 

From : CD - 4 

Contact : IA | 

Approved By: 

Drafted By: 

Case ID #: (U) 

Title: {S//«F)[ 

Synopsis: (U// F0U0) To document background research of Platte 

River Networks . 




Details: (U// FOUO ) A 24 June 2015 lestter from Williams & 

Connolly LLP to the U.S. Department of State {USDS) Office of 
Inspector General identified that the server equipment which 
hosted former Secretary of State Clinton' s ©clintonemail . com 
account during her tenure as Secretary of State is in the 
custody of Platte River Networks (PRN) . The server is allegedly 
maintained at an unidentified secure data center and is 
allegedly no longer active. Williams & Connolly believes the 
server no longer contains data from former Secretary Clinton' s 
©clintonemail . com account . 

(U//F OUQ ) CD conducted open source and FBI database 
checks of PRN and associated persons. Results are as follows: 

(U) ADDRESSES 

(U/ /FOUO) According to the PRN website 
(www.platteriver.com), PRN recently moved to a new 12,000 ft. 
office space at 5700 Washington Street, Denver Colorado 80216. 


b6 

b7C 


bl 

b3 

b7E 


T//N 0F0R N 
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To: 

Re: 


CD- 4 
(U) 


S^gR^T/ /NOFORN 


CD- 4 


bate: 07/24/2015 


b3 

b7E 


According to LexisNexis searches, the following additional 
addresses are also associated with PRN: 


* 


be 

b7C 


* 11900 E Cornell Ave 
Aurora, CO 20014 

* 5550 Britton Pkwy 
Hilliard, OH 43026 


be 

b7C 


(u/ /-FOU© - ) The LexisNexis search identified the 11900 E Cornell 
Ave, Aurora, CO 20014 as a property owned by Platte River 
Networks for the purposes of "EQUIPMENT FURNITURE ETC." 


(U} Open source inf ormation indicated | 

lis a private residence. 


(u/ /FQHQ) Experia n records indicated) 

is listed as a residential address fori 
i r of prn . 

(U) PHONE, FAX, & EMAIL 


(U/ AFOUO) The search of LexisNexis also identified PRN's ph one 
as 303-2 55-1941 and taxpayer identification number (TIN) as | 1 

1 PRN ; s phor^ e number is also associated in Experian with 
a former employee of PRN, 


(U) PRN's email was identified through open source as 
crc@platteriver . com and the fax number was listed as 303-474- 
3942. 


b6 

b7C 


b6 

b7C 


b4 

b6 

b7C 
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(U) PRN BUSINESS SCOPE 

(U) Open source information indicates PRN has approximately 25 
employees. According to the PRN website, PRN provides the 
following services: 

• (U) Managed IT Services - Intuition: Intuition appears to 
be a business technology associated with network 
infrastructure (including servers, storage area networks, 
firewalls, switches, and workstations) which is monitored 
by PRN's Intuition Operations Center,. Intuition provides 
network security delivered on premise and through the 
cloud, including endpoint security for servers and devices, 
next generation firewalls, unified threat protection, 
monitoring, mobile protection, web and email security. 
Intuition also provides remote management of mobile devices 
including remote monitoring, setup, security and vendor 
management . 

• (U) Technology: According to the PRN website, PRN offers 
consultations for technology projects, technology 
procurements, and continuity of business assessments and 
solutions. PRN has over 25 full-time engineers specializing 
in integration, virtualization, security, remote access, 
wireless, mobility, cloud, exchange, server, desktop, 
firewall, switching, system administration, storage, 
disaster recovery, business continuity, endpoint 
protection, archiving, data recovery, power, migration. 
Office 365, cabling, VoIP, encryption, ISP, voice/data 
bandwidth, active directory, group policy, and DNS. 

• (U) Cloud: PRN provides cloud computing with expertise in 
hybrid, public, and private cloud infrastructure. PRN 
offers desktop virtualization to provide a flexible and 
secure desktop delivery. PRN' s cloud services provide 
storage, backup, and disaster recovery, ensuring their 
clients' data is always available and protected. PRN 
maintains cloud security solutions provide up-to-date 
protection by utilizing the ability to push critical real 
time updates to all devices on the networks. PRN offers 
Microsoft's Office 365 to clients, enabling cloud-based 
Microsoft Office application usage. 

• (U) Telecom: PRN claims to represent the top 25 bandwidth 
providers and provides on-site cabling assessments to 

5£ES«3J£/N©FeR» 
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To : CD-4 From: CD-4 

Re: (U) | ~~| Date ; 07/24/2015 


determine if clients are equipped with sufficient CAT 5/6 
cabling for network, voice and data to perform at top 
speeds. PRN also offers conference call and web meeting 
solutions, including hardware, software, and managed 
services. PRN' s website advertises business mobility by 
stating : 

"Your business must be mobile, including your company 
workforce. You need to access your company data from all 
devices, anywhere and anytime. We represent the top 
carriers from across the country and can procure, monitor 
and manage all of your mobile devices including laptops, 
tablets, and smartphones - iPhones, iPads, Droids, and 
Windows . " 

(U) FBI OBSERVED COMPROMISES OF PRN CLIENTS 

(U) In July 2015, on behalf of FBI San Diego,, FBI Denver cited 
PRN as providing contract IT services for a' hot-profit business 
in Denver that was the potential victim of a 1 computer intrusion 
I l PRN Director of Consulting 

Services at Platte River Networks provided log and system files 
for the victim company' s website to FBI Denver circa 10 July 
2015. 

(B//NF) FBI Denver cited PRN as providing contract IT services 
for a law firm in Denver that was the victim of a computer 
intrusion in March 2010. The Denver law firm terminated their 
contract with PRN shortly thereafter. According to the case 
file, FBI Denver did not contact PRN regarding the computer 
intrusion . 

(U) TIMELINE 

(U) The following is a timeline of key PRN events provided on 
the PRN website: 


• 

(U) 

2002 : 

PRN 

founded 

• 

(U) 

2004 : 

PRN 

founding partners hired the first employee 

• 

(U) 

2005 : 

PRN 

began offering cloud services 

• 

(U> 

2008 : 

PRN 

launched Intuition 


s|333d5T/ / NO F QRN 




To: CD- 4 

Re: (U)T 


From : 


JZSt&EiJ / NOFOR N 

CD-4 

Date: 07/24/2015 


• (U) 2009: PRN offered full Managed Services 

• (U) 2010: PRN launched Telecom Division 

• (U) 2012: PRN launched the Intuition Operations Center and 
associated Help Desk 

(U) PRN EXECUTIVE MANAGEMENT 

(U) PRN's website identified PRN executive management and 
provided additional information for each person. 


POSITION ADDITIONAL INFORMATION 



sfee£$T/ /MOFOR N- 
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To: CD-4 

Re: (U) [ 


/W©POM9“ 


CD-4 

] Date: 07/24/2015 



^Jj • I 


(U) CORPORATE PARTNERS 


b6 

b7C 


b6 

b7C 


(U) According to their website, PRN maintains hardware 
partnerships with Dell, Fortinet, Allworx, Datto, CISCO, ADTRAN, 
HP, EQUALLOGIC, EATON, PowerADVANTAGE, and Synology. 

(U) PRN's software partners include Microsoft, Office365, 
mimecast, WEBROOT, vmware, Dell, Autotask, LabTech, Datto, 

Sky Kick, STORAGE CRAFT, VEEAM, and Worldox. 

(U) PRN's service partners are Windstream Communications, 
CenturyLink, PanTerra, Comcast, Integra, RingCentral, TW 
Telecom, AT&T, MobileWare, and MHO. 

(U) PRN's strategic partners include INGRAM Micro, CUSN, and 
Trust Alliance. 


♦ ♦ 


Sfrpg|T/ /NOFORN 
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• # 


U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D C. 20535-0001 


ALL IMSGKM&T IOH COM TA I NED 

3S3ZIH IS UNCLASSIFIED 

DATE 11-03-2016 BY J76J18T80 NS ICG 



August 18, 2015 


b7E 


Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 1 8, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 


1 

2 

3 

4 

5 

6 

7 
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9 
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43 
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54 

55 

56 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 

You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI’s investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
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in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these accou nts as to your actions to preserve the referenced files 


and records, please contact Special Agent 
and before taking any such actions. 


as soon as possible 


b6 
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This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connec tion; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such SemCd: (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to .ihe requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other fonn. 
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If vou have any questions regar ding this request, please direct all inquiries to Spe cial Agent 
who can be reached atl foi 


b6 

b7C 


Sincerely, - 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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ALL INFOF&1ATIGH CONTAINED 

HZ HZ IN IS UNC LAS 5 IF IED 

DATE 11-03-2016 EY J76J13T30 NSIC 


U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 


Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after, the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
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alert the subscriber or user of these accou nts as favour actions to preserve the r eferenced files 


and records, please contact Special Agent 
and before taking any such actions. 


as soon as possible 


b6 

b7C 


This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of sendee and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1. Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. .Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 
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who can be reached at 

1 n 1 — r 

or 
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Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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ALL IN FORMAT ION CONTAINED 

HEREIN IS UNCLASSIFIED 

CATE 11-03-2015 BY J75J1STSD NS ICG 


U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 


b7E 


Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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28 

29 

30 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these accou nts as to vour actions to preserve, the referenced files 
and records, please contact Special Agent as soon as possible 

and before taking any such actions. 


This preservation request applies to the following records and evidence: 


b6 

b7C 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1. Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 
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7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regar ding this request, p lease direct all inquiries to Sp ecial Agent 



who can he reached at 


or 
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Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


HRC-616 



b6 

hlC 


ALL IHrOR^ATICN CONTAINED 

HE RE I H 13 UNCLASSIFIED 

DATE 11-03-2016 BY J7€J18T80 NSICG 


U.S. Department of Justice 

Federal Bureau of Investigation . 

Washington, D.C. 20535-0001 



August 18 , 2015 


Re: Request for Preservation of Records 

Dear Custodian of Records: 


Pursuant to Title 1 8, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 




and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these accou nts as to your actions to preserve the referenced files 


and records, please contact Special Agent 
and before taking any such actions. 


as soon as possible 


This preservation request applies to the following records and evidence: 
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A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscribers), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 


HRC-622 




relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you hav e any questions regar ding this request, p lease direct all inquiries to Spe cial Agent 


bvho can be reached at 


or 


b6 

b7C 


Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 


b7E 


Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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You are hereby requested to preserv e the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco unts as to your actions to preserve the referenced files 


and records, please contact Special Agentj^ 
and before taking any such actions. 


as soon as possible 


This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscribe^ s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 




3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regard ing this request, p lease direct all inquiries to Sp ecial Agent 


hvho can be reached at 


K 


Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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DATE 11-03-D 01 5 BY J7SJ18TS0 NS ICG 


U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 

John Kerry 
Secretary of State 
U.S. State Department 
2201 C Street, NW 
Washington, DC 20520 

Re: Request for Preservation of Records 

Dear Secretary Kerry: 

Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 


b6 

b7C 

b7E 


HRC-632 







116 

117 

118 
119 
120 
121 
122 

123 

124 

125 

126 

127 

128 
129 

130 

131 

132 

133 

134 

135 

136 

137 

138 

139 

140 

141 

142 

143 

144 

145 

146 

147 

148 

149 

150 

151 

152 

153 

154 

155 

156 

157 

158 

159 

160 
161 


b6 

b7C 

b7E 


HRC-635 






208 

209 

210 
211 
212 

213 

214 

215 

216 

217 

218 

219 

220 
221 
222 

223 

224 

225 

226 

227 

228 

229 

230 

231 

232 

233 

234 

235 

236 

237 

238 

239 

240 

241 

242 

243 

244 

245 

246 

247 

249 

250 

251 

252 

253 

254 


b6 

b7C 

b7E 


HRC-637 








301 

302 

303 

304 

305 

306 

307 

308 

309 

310 

311 

312 

313 

314 

315 

316 

317 

318 

319 

320 

321 

322 

323 

324 

325 

326 

327 

328 

329 

330 

331 

332 

333 

334 

335 

336 

337 

338 

339 

340 

341 

342 

343 

344 

345 

346 


b6 

b7C 

b7E 


HRC-639 








393 

394 

395 

396 

397 

398 

399 

400 

401 

402 

403 

404 

405 

406 

407 

408 

409 

410 

411 

412 

413 

414 

415 

416 

417 

418 

419 

420 

421 

422 

423 

424 

425 

426 

427 
428 . 

429 

430 

431 

432 

433 

434 

435 

436 

437 

438 


b6 

b7C 

b7E 


HRC-641 




b6 

b7C 

b7E 



439 

440 

441 

442 

443 

444 

445 

446 

447 

448 

449 

450 

451 

452 

453 

454 

455 

456 

457 

458 

459 

460 

461 

462 
463 
464 ' 

465 

466 

467 

468 

469 

470 

471 

472 

473 

474 

475 

476 

477 

478 

479 

480 

481 

482 

483 

484 


HRC-642 




531 

532 

533 

534 

535 

536 

537 

538 

539 

540 

541 

542 

543 

544 

545 

546 

547 

548 

549 

550 

551 

552 

553 

554 

555 

556 

557 

558 

559 

560 

561 

562 

563 

564 

565 

566 

567 

568 

569 

570 

571 

572 

573 

574 

575 

576 


fo6 

b7C 

b7E 


HRC-644 







624 

625 

626 

627 

628 

629 

630 

631 

632 

633 

634 

635 

636 

637 

638 

639 

640 

641 

642 

643 

644 

645 

646 

647 

648 

649 

650 

651 

652 

653 

654 

655 

656 

657 

658 

659 

660 
661 
662 

663 

664 

665 

666 

667 

668 
669 


b6 

b7C 

b7E 


HRC-646 






670 

671 

672 

673 

674 

675 

676 

677 

678 

679 

680 
681 
682 

683 

684 

685 

686 

687 

688 

689 

690 

691 

692 

693 

694 

695 

696 

697 

698 

699 

700 

701 

702 

703 

704 

705 

706 

707 

708 

709 

710 

711 

712 

713 

714 

715 


b6 

b7C 

b7E 


HRC-647 







762 

763 

764 

765 

766 

767 

768 

769 

770 

771 

772 

773 

774 

775 

776 

777 

778 

779 

780 

782 

783 

784 

785 

786 

787 

788 

789 

790 

791 

792 

793 

794 

795 

796 

797 

798 

799 

800 
801 
802 

803 

804 

805 

806 

807 

808 


b6 

b7C 

b7E 


HRC-649 









855 

856 

857 

858 

859 

860 
861 
862 

863 

864 

865 

866 

867 

868 

869 

870 

871 

872 

873 

874 

875 

876 

877 

878 

879 

880 
881 
882 

883 

884 

885 

886 

887 

888 

889 

890 

891 

892 

893 

894 

895 

896 

897 

898 

899 

900 


b6 

b7C 

b7E 


I 


HRC-651 




901 

902 

903 

904 

905 

906 

907 
90S 

909 

910 

911 

912 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco unts as to vour actions to preserve the r eferenced files 


and records, please contact Special Agena 
and before taking any such actions . *- 


as soon as possible 


This preservation request applies to the following records and evidence: 

A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 
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% % 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If yon hav e any questions regard ing this request, p ease direct all inquiries to Spec ial Agent 

or 


who can be reached at 


be 

b7C 


Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-03-2016 BY ,376218180 HSICC 



August 18, 2015 
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Re: Request for Preservation of Records 


Dear 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
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a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco unts as to your actions to preserve the r eferenced files 


and records, please contact Special Agentj 
and before taking any such actions. 


as soon as possible 


b6 
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This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscribers), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. . Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protoc ol address of the source of the connection; 

6. Telephone cellar identification records; and 

7. Connecticjt vafotms£ion for other computers to which the user of the above-referenced 
accounts OQ-mjected, by any means, during the connection period, including the 
destinatio n P address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
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• « 

or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you hav e any questions regar ding this request , please direct all inquiries to Spec ial Agent 


who can be reached at 


loii 


b6 
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Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 
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Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 1 8, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 


HRC-659 


a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco unts as to y our actions to preserve^ the r eferenced files 


and records , please contact Special Agen\ 
and before taking any such actions. 


ps soon as possible 


This preservation request applies to the following records and evidence: 
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A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscribers), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
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relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you hav e any questions regard ing this request, pl ease direct all inquiries to Spe cial Agent 


who can be reached at 


or 


fo6 

b7C 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


H RC-661 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 
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Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 1 8, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises ajter the date of this request. 


You are alsc 'rfequfidted not to disclose the existence of this request to the subscriber or any 
other person, other than ( as pessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type ^f disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco unts as to. your actions to preserve the referenced files 


and records , please contact Special Agenn 
and before taking any such actions. 


as soon as possible 


This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscribers), customers), account 
holders), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact infomiation, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 





4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If yon have any questions regard ing this request, p lease direct all inquiries to Spe cial Agent 
[vho can be reached at or 


be 

b7C 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 
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Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 1 8, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 

You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco unts as to vour actions in nreserve the referenced files 
and records , please contact Special Agenn as soon as possible 

and before taking any such actions. 

This preservation request applies to the following records and evidence: 
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A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, Whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to w'hich the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 

D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regar ding this request . 


who can be reached at£ 


or 


ease direct all inquiries to Spe cial Agent 
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Sincerely, 



Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


HRC-668 
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U.S. Department of Justice 

Federal Bureau of Investigation 

Washington, D.C. 20535-0001 



August 18, 2015 
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Re: Request for Preservation of Records 

Dear Custodian of Records: 

Pursuant to Title 18, United States Code Section 27Q?(f) ; this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legftl process 
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You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco unts as to vour actions to preserve the referenced files 

as soon as possible 


and records, please contact Special Agent^ 
and before taking any such actions. 
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This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen na m es or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 

C. All connection logs and records of user activity for the requested account, including: 

1 . Connection date and time; 

2. Disconnect date and time; 

3. Method of connection (e.g., telnet, ftp, http); 

4. Data transfer volume; 

5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 


HRC-671 



D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in elqetfaa*c or other form. 


If you hav e any questions regard ing this request ,- direct all inquiries to Spe cial Agent 
who can be reached at| jeif 


be 

b7C 


Sincerely, 


Charles H. Kable IV 
Section Chief 

Counterintelligence Division 


HRC-672 



(Rev. 05-01-2008) 



7 NOFORH 
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FBI I11FO. 

CLASSIFIED BY: H3ICG J76J18TS0 
REASQH : 1.4 <C) 

DECLASSIFY ON: 12-31-2040 
DATE : 11-QS-2Q16 


Precedence.;. routine 
T o: Wasfiingtpon Field 

From: 


Date: 08/25/2015 


Washington Fife Id 
Cl -13 

Ofehhact : SJjJ 


Approved By: 


gable Charles H IV 


Drafted By: 

■TTi Case ID #: &S{) 

1 u f 

Title: 


-•73 


(S) 


MISHANDLING OF CLASSIFIED ; 

UNKNOWN SUBJECT OR COUNTRY ; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U / /-F OUQ j- Deputy Assistant Director (DAD) 

Counterintelligence Division (CD) , a Declassification Authority of 
FBI information, declassifies the following information for release 
as appropriate. 

Classd^ied^By: H83J83T44 
Derived From7''FB5>MSTC^dated 20130301 
Declasgify^On: 20401231 

Details: (U// FOUO) This communication declassifies the existence 

of the captioned matter with the signature of the Deputy Assistant 
Director (DAD) Counterintelligence Division (CD) , a 
Declassification Authority of FBI information. Verbal authorization 
to declassify this information was previously provided by Assistant 
Director (AD) Randall Coleman, Counterintelligence Division (CD) , 
an Original Classification Authority of FBI information, on August 
21, 2015. 

(U/ / F0U6) The DAD authorizes the declassification of the following 
inf ormat ion : 


// NO FORM 


b6 

b7C 


bl 

b3 

b7E 
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"jpgjSs xj /NoroR W 

FEDERAL BUREAU OF INVESTIGATION 


(D//few) In July 2015, the FBI initiated the captioned 
investigation based on an 811 referral from the Inspector General 
for the Intelligence Community (ICIG) regarding the possible 
compromise of classified national security information. 

( U / /" FOU G^ The potential compromise was identified when, as part of 
a Freedom of Information Act (FOIA) request, the U.S. Department of 
State (DoS) Office of Inspector General and the ICIG were reviewing 
electronic mail communications from a private server previously used 
by a State Department official during their tenure at DoS. An initial 
review of this material identified several emails containing 
classified national security information some of which was Top 
Secret . 

(U/ /T OU Q) NSLB concurs that the declassification of the existence 
of this investigation is necessary. 

(U) In an attempt to acquire authority to reveal certain information 
as part of future criminal proceedings, FBI WFO certifies the 
following: 

1. (u) No previously unknown sources or informants were revealed 
in the identified material; 

2. (U) No sensitive sources or methods were disclosed; 

3. (U) No information will be disclosed which will negatively 
impact other case equities; and 

4. (U) No classified information from any other agency or 
foreign government will be disclosed. 


♦ ♦ 
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FBI INFO. 

CLASSIFIED BY: NSICG 276J18T80 
REASON: 1.4 !C; 

DEC LAS S I FY CM: 12-31-2040 

/ /HOFOnH DATE: 11 - 03-2015 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 08/27/2015 


To: Washington Field 


From: Washington Field 

CI-13 

Contact : SA 


Approved By: 
Drafted By: 
Case ID #: (U) 

Title: (S//NF) 


-'2x? 


Synopsis: Jfl 1 , £s^/ifF0 Attaches records provided by Department of 
State. 



Details: (U/ /FOUO ) On August 13, 2015, in response to an FBI 
records request dated August 11, 2015, the U.S. Department of 
State (DoS) , provided employee profiles for 14 of the 15 
requested individuals. 


(U/ /FOUO) Additionally, DoS was able to locate signed copies of 
Classified Information Nondisclosure Agreements (Standard Form 
312) for 9 of the 15 individuals. 


{ U / / FOU0-) These documents are attached to the file in a physical 
1A. 


b6 

b7C 


bl 

b3 

b7E 


♦ ♦ 
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FEDERAL BUREAU OF INVE 

EVIDENCE CHAIN OF CUSTODY 


HERE III IS UHCLAS5IFIEE 
fDATE 11 -OS-2 015 BY J76J18T80 

L HXl 1 


Kvidenee Type: 

Itfrl General 
n Wtgital 

□ Drugs 

1 1 Valuables 

Special Handling Instructions 


□ hazmai 

n Latents 

O l'( iJ 

t | Req h Charging 

PI i recze 

1 1 Refrigerate 

r] Biohazard 



PI Other 




□ hi rearms/ Weapon 

□ Hreaims/Olher ^ 




Relinquished Custody 


Signature; 


i 


Printed Name/Agency| 


Reason: 


*rQ fik/A*srtoo 


Relinquished Custody 


Signature: 


Printed Name/Agency: 


Reason: 


Relinquished Custody 


Signature: 


Printed Name/ Agency: 


Reason: 


Relinquished Custody 


Signature: 


Initial Receipt 


Signature of Seizing tndividua 


Printed Name/ Agency: 


Reason: Initial Collection 


Ja 


u 


Collected By; I 
Agency: 


V&T 


Date and 
Time 


tjujtf 


Date and 
Time 


Date and 
Time 


Date and 
Time 


Printed Name/Agency: 


Reason: 


Accepted Custody 


Signature 


!re|^ 


Printed Name/ Age ney:^j^>^ J 

Reason: C M'C £--<Av^ 


Date and 


Time 






Date and 
Time 


H'&k 


Accepted Custody 


Signature: 


Printed Name/Agency; 


Reason: 


Accepted Custody 


Signature: 


Printed Name/ Agency: 


Reason; 


Accepted Custody 


Signature: 


Printed Name/ Agency: 


Reason: 


Date and 
Time 


Date and 
Time [ 


Date and 
Time 


Relinquished Custody 


Date and 
Time 


Accepted Custody 


Date and 
Time 


Signature: 


Signatu re: 


Printed Name/Agency: 


Printed Name/ Agency: 


Reason; 


Reason: 


Relinquished Custody 


Date and 
Time 


Accepted Custody 


Dale and! 
Time 


Signature: 


Signature: 


Pr i n te d N ame/ Agency : 


Printed Name/ Agency: 


Reason; 


Reason: 


Kirearn ( ertification by (PK! /SWAT) / Kr plosive Material Certification by (SAB I ): 

AIK Trace Kurm Completed: Q 

Printed Name: 

NUC: □ 

Signature: 

Pate: 



Case II): 


IB 


Barcode: 
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NS ICG 
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all mrtmiATicm caw tamed 
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HEREIN IS UNCLASSIFIED 

LATE. 11-03-2016 BY J76J1STSD HSICG 

(iA 1 1 \ny i 


EVIDENCE CHAIN OF CUSTODY 


Kvidenee Type: M General □ Drugs "□ Firearms/ Weapon 

□ Digital □ Valuables □ Firearms/Other / mM jge 


; - ■ — 

Special Handling instructions 

Initial Receipt 

Date an 
Time 

i 

□ HAZMAr C] Intents O J-"( iJ 

□ Req. Charging □ Freeze □ Refrigerate 

r] Biohazard 

C3 Other 

Signature of Seizing Individual: 

t/lf. 


Printed. Name/Agency | 

/f&! 


Reason: Initial Collection 



Collected By: XA | /fftf 

Agency: 


Relinquished Custody 


Date and 
Time 

Accept 

1 

ed Custody 


Date an 
Time 

r 

Siguaturej 


l/'I’S' 

•/Vf 

Signati 



f/Ww 

i&f' 

% 

Printed Name/Agency: 

ffe) 

Printed Name/Agency: Oa^CT 

Reason: *> 

Reason: CA^l" CV/taO 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date atn 
Time 

i 

Signature: 


Signature: 

■ 


Printed Name/Agency: 

Printed Name/ Agency: 

Reason; 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date am 
Time 

r 

Signature: 


Signature: 

1 


Printed Name/Agency: 

Printed Name/ Agency: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date am 
Time 


Signature; 


Signature: 



Printed Name/Agency: 

Printed Name/Agency: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 


Signature: ^ 


Signature: 


- 

Pr i nte d N ame/ Agen cy : 

Printed Name/Agency: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 

- 

Signature: 



Printed Name/Agency; 

Printed Name/Agency: 

Reason: 

Reason: 


he 

hlC 


he 

hlC 


Firearm Certification by (PH/SWAT) / Kxplosive Material Certification by (SAB I ): 

A1F trace Form Completed: O 

“ 

Printed Name: 

NCIC: □ 


Signature: 


Date: 




Case ID: 


Ml 


Barcode: 
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CLASSIFIED BY: N3ICG J7CJ18T80 
^REASON : 1 4 (C) 

’DECLASSIFY ON: 12-31-2040 
CATE: 11-05-2016 


ALL INYCFMATIDN CONTAINED 



HEJREIH IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 



FEDERAL BUREAU OF INVESTIGATION 

Collected Item Log 


Event Title: (S) 


Approved By: 


Date: 09/03/2015 


Drafted By: 


Case ID 


#: 




(S//tt*4| | 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 



Full Investigation Initiated: 07/10/2015 


Ui 


Collected From: 


Receipt Given?: 
Holding Office: 


CsO Partner Katherine M. Turner 
Williams & Connolly LLP 
725 12th St NW 

Washington, District Of Columbia 20005 
No 

WASHINGTON FIELD 


Details : No Details Provided 


Item Type 

« IB General 


Description 

fjjj Banker Box of Documents 

Collected On: 08/25 /2015 
Seizing Indivi dual: | 

Collected By: 

Location Area: NA 
Specific Location: Na 


bl 

b3 

b7E 


b6 

b7C 


bl 

b3 

b7E 


bS 

blC 


SffeflfT//* K>FQ RH 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its 
contents are not to be distributed outside your agency. 
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[T/ /HO F O RM 


Title; 

Re : I 


09/03/2015 


hi 

b3 

b7E 


IB General ;JJj f)S(J Banker Box of Documents 
Collected On : 08/25 /2015 

Seizing Indivi dual : | 
Collected By: 

Location Area: NA 
Specific Location: NA 

IB General JJ) Banker Box of Documents 

Collected On: 08/25/2015 
Seizing Indivi dual : | 
Collected By: 

Location Area: NA 
Specific Location: NA 


IB General ;jj| jXj Banker Box of Documents 
Collected On: 08/2 5/2015 
Seizing Indivi dual : f 
Collected By: 

Location Area: 


~N7T 


Specif ic Location: 


NA 


b6 

b7C 


b6 

b7C 


b6 

b7C 


♦ ♦ 
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FEDERAL BUREAU OF I NVESTIGATION 


Event Title : ( S )l 


Date: 09/03/2015 


bl 

b3 

b7E 


Approved By: 


Drafted By: 


jo 


#: 




(S//HT) | | 

MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER 


(SIM) 


b6 

b7C 


bl 

b3 

b7E 



Full Investigation Initiated: 07/10/2015 


■U] Collected From: CHS 

Receipt Given? : No 
Holding Office: WASHINGTON FIELD 


Details: No Details Provided 


I tem Type 

IB Digital 


Description 

fUj USB Thumbdrive 

Collected On: 09/03 /2015 

Seizing Indivi dual : | ' 

Collected By: 

Location Area : NA 
Specific Location: NA 

Device Type : USB Micro Storage Device (thumb drive ) 
Number of Devices Collected: 1 


b6 

b7C 



This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its 
contents are not to be distributed outside your agency. 
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CLASSIFIED BY: HSICG J76J18T80 
REASON 1.4 (C) 

DECLASSIFY ON: 12-31-2040 
CATE: 11-03-2016 


ALL INFORMATION CONTAINED 
HEREIN IS UNC LAS S IF IED EXCEPT 
WHERE SHOWN OTHERWISE 


FD-1087 (Rev. 5-8-10) 


/ HO FORM 



mm 


Official Record 


■i^tvabirTC • ♦ t«n wtVrt fry • 
cwltotf fBl • ntormaljon F><lr:r> 


FEDERAL BUREAU OF INVESTIGATION 

Co I looted Hem Log 


Event Title: 
Approved By : 
Drafted By: 
Case ID # 


(S) 


Date: 09/03/2015 


bl 

b3 

b7E 


b6 

b7C 


^65 


(S//W 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


bl 

b3 

b7E 



Pull Investigation Initiated: 07/10/2015 

: |Uj Collected From: Partner Katherine M. Turner 

Williams & Connolly LLp 
725 12th St NW 

Washington, District Of Columbia 20005 


Receipt Given? : 

No 




Holding Office: 

WASHINGTON FIELD 




Details: Afo 

Details Provided 




Item Type ,jfi 

IB Digital 1 

Description 

1 X Apple Model A1466 EMC 2925 
Collected On: 08/25/2015 

S/N: 

C02 P68WBG94 0 


- 

Seizina Individual : 



b6 


Collected By: 



b7C 


Location Area: NA 
Specific Location: NA 
Device Type: Computer 
Number of Devices Collected: 


T//NM*eRN» 


This document contains neither recommendations nor conclusions of the FBI It is the properly of the FBI and is loaned to your agency; it and its 
contents are not to be distributed outside your agency. 
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Titl e: (S) 

Re : r 


09/03/2015 


bl 

b3 

b7E 


IB Digital l x Apple 

Model A14 66 EMC 2925 

S/N: 

C02 P67K3G9 40 

Collected On: 

08/25/2015 



Seizing Individual : 


b6 

Collected By: | 



b7C 

Location Area: 

NA 



Specific Location:. NA 



Device Type : 

Computer 



Number of Devices Collected: 1 



IB Digital ;Uj )$) 1 X Lexar 

16 GB USB Thumbdrive 

- N12610 

Collected On: 

08/25/2015 



Seizing Individual: | 


□ b6 

Collected By: 

1 

J 

b7C 

Location Area: 

NA 



Specific Location: NA 



Device Type : 

USB Micro Storage Device (thumb drive) 

Number of Devices Collected: 1 



IB Digital 1 X USB Thumbdrive Labeled ”HC 

Prime 

2" 

Collected On: 

08/25/2015 



Seizina Individual: 1 

1 b€ 

Collected By: 



b7C 

Location Area: 

FJa 



Specific Location: NA 



Device Type: 

USB Micro Storage Device (thumb drive) 

Number of Devices Collected: 1 



IB Digital ’U> 1 X Apple Model A14 66 EMC 2925 

S/N: 

ClMP69VuG940 

1 X MagSafe 2 

Power Adapter 



Collected On; 

08/25/2015 



Seizing Individual: I 


1 b6 

Collected By: 

1 

J 

b7C 

Location Area: 

NA 




Specific Location: NA 
Device Type: Computer 
Serial Number: C1MP69VUG940 
Number of Devices Collected: 1 
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Titl e: (5) 

Re: I 


09/03/2015 


bl 

b3 

b7E 


IB Digital -fl) X 1 x Lenovo Yoga 211 Model 20428 S/N:[ 
1 X Power/AC Adapter Model AD2X65NLC2A 

Collected On: 08/25 /2015 

Seizing Indivi dual : 

Collected By: | 

Location Area: NA 
Specific Location: NA 

Device Type: Computer 

Serial Number: I I 

Number of Devices Collected : 1 


.IB Digital ij}\ 


1 X Lenovo Type I 
AC Adapter P/N: 92P1109 
Collected On: 08/25 /2015 
Seizing Indivi dual: I 
Collected By: 

Location Area: NA 
Specific Location: NA 
Device Type : Computer 
Number of Devices Collected: 


IB Digital (X) 1 X Lenovo Type 4236 - VQ5 S/N: 

1 X AC Adapter Model 42T4418 

1 X Dell Mouse DPPID: CN - 09RRC7 - 48729 - 385 - 0PRS 


Collected On: 08/25 /2015 

Seizing I ndivi dual : 

Collected By: 

Location Area: NA 
Specific Location: NA 
Device Type : C omputer 
Serial Number: 


Number of Devices Collected: 


bS 

blC 


bS 

blC 


bS 

blC 


♦♦ 
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FEDERAL BUREAU OF INVESTIGATION 

Electronic Communication 


Title: (U//FW! Submit 1A Date: 09/04/2015 

From: WASHINGTON FIELD 

WF-CI13 

Contact : 


Approved By : SSA 


b6 

b7C 


Drafted By: 


Case ID 



- < db (S//-SF-) 



MISHANDLING OF CLASSIF! 


UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U// FQUO ) To submit to the file a 1A associated with the 

referenced serial . 



Full Investigation Initiated: 07/10/2015 


Reference : 


Serial 


82 


bl 

b3 

b7E 


b3 

b7E 


Enclosure (s) : Enclosed are the following items: 

i, {u//TOt?e}| 


Details : 

(U//TW6-) This communication submits to the file a 1A associated 
with Serial 82 of the captioned f ile . 


b7E 


/ MOFORU - 
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Title : 
Re : 


(U/Zf'mQ) 


Submit 1A 

09/04/2015 


b3 

b7E 


♦♦ 


T// MOgORM 


2 


HRC-697 




bS 
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> 


HRC-698 



DECLASSIFIED BY. HSICG J7SJ18T8D 



Interviewee: (U) Justin Grego ry Cooper 
(U//FOH0) DOB: 


(XJ//F©ee)S£££iI 
(U//fWO]| 


Summary: Justin Cooper registered the first secure socket layer (SSL) 
certificate for the mail.clintonemail.com domain with Network 
Solutions on 03/3 0/2009. 2 Additionally, Cooper is currently an advisor 
to former President Bill Clinton and a Senior Advisor to the 
technology company, Decision Sciences Corporation. 



be 

b7C 

b7E 


Details: The mail.clintonemail.com domain was registered on 01/13/2009 by Perfect Privacy, 
LLC. 4 Justin Cooper registered with Network Solutions the first secure socket layer (SSL) 
certificate for the mail.clintonemail.com domain on 03/30/2009, allowing encryption for web- 
based applications. A second SSL certificate was registered on 02/05/2012 with Network 
Solutions, but no individual was listed on the registration. The third, and current, SSL certificate 
was registered on 09/13/2013 with GoDaddy without an individual listed on the registration 2 


(U) Justin Cooper serves as an advisor to former President Bill Clinton. Cooper’s responsibilities 
include managing President Clinton’s personal and professional relationships, and assisting with 
political, business and personal finance issues. Cooper served many roles while President Clinton 
was in office, including Senior Advisor and The President’s Aide. He has participated in 
extensive international travel with President Clinton and helped the President author three books. 
Cooper was involved in the establishment of the Clinton Foundation and continues to support it 
along with the Global Clinton Initiative and the Clinton Family Foundation 3 , Coy per holds an 
email address tied to President Clinton’s domair 


(U) Cooper is listed as the point of contact for Calle Mayor, LLC. The corporation’s address is 


the same as the C 
property at which! 


inton residence in Chappaqua, New York. Calle Mayor, LLC owns the 


(U) Cooper has participated in advisory engagements outside of his role with President Clinton. 
Cooper is the founder and CEO of Foxcroft Strategy Group, LLC. In this capacity, Cooper 


1 . I 

2 Analysis conducted by Venafi TrustNet, “Digital Certificate Forensics: What Venafi TrustNet Tells Us about the Clinton Email 
Server” (03/1 1/2015) 

3 Cooper Biography on Decision Sciences Corporation website 

4 Whois.com 

5 Department of State Consolidated Consular Database information 

6 New York Times, “Roger Clinton is Wary, Chatty and Still Occasionally Attracting Attention” (07/06/2015) 


b6 
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b6 
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b7E 
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D 
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provides diverse consulting services to agencies in the government, non-profit and private 
sectors. 3 Foxcroft Strategy Group, LLC was incorporated in Delaware on 1 1/12/201 3. 7 Cooper is 
also currently a Senior Advisor for Decision Sciences Corporation, a technology company that 
utilizes cargo scanning technology to detect weapons of mass destruction (WMD) proliferation, 
as well as explosives and contraband smuggling. Decision Sciences Corporation utilizes an 
advisory board of diverse backgrounds, including scientists, business leaders and government 
officials to improve their business capabilities. 8 Finally, Cooper previously served as a Senior 
Advisor to Teneo Holdings. Teneo Holdings is a consulting firm co-founded by Doug Band, a 
prior aide to President Clinton. Cooper is not currently listed on the website of Teneo Holdings. 9 


(U//8 BtTf Cooper s erved as the B1/B2 non-immigrant visa (NIV) sponsor for[ 
(DOBJ 1 I on NIV applications dated 10/23/2012 and 07/08/201 5 1_ 



be 

b7C 


(U) Cooper received his Juris Doctorate from Fordham University and a Bachelor of Arts from 
American University. 3 


II! 


;ui 


^//NF) Presence im emails provided to the FBI om ©8/06/201 § 

jfSj'/NF) Cooper is associated with approximately 60 emails that w ere provided to the FBI on 
08/06/2015. Cooper’s email activity indicates he an d I were the principal conduit to 

provide information to President Clinton, as President Clinton did not appear to utilize a direct 
email address. The Clinton Foundation’s Haiti relief effort in 2010 was the most frequent topic of 
conversation by Cooper, encompassing approximately ten emails. 


(U) Author: SOs[ 
(U) Approval: ASC 

ssa| 




] . 

- 

V/>y 
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' Stale of Delaware Division of Corporations, File number 5431 135 
3 Decision ^dances Corporation website 
J Judicial Watch* “Teneo & The Clinton Machine” (04/30/2015) 
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- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/01/2015 




September 1, 2015, Special Agent| 
ssistant United States Attorney, Eastern District of Virginia (EDVA) and| 


telephonically spok e withf 


Court Security Officer, United States Department of Justice (DOJ), to coordinate the transfer of digital 
media from the Federal Bureau of Investigation (FBI) to DOJ. 


ollowing the discu ssion. SA[ 


and SA 


physically provided a 


[Security Specialist, DOJ. The DVD was provided by the Operational 


DVD to[ 

Technology Division (OTD) and contained a copy of digital content previously given to the FBI by 
Williams and Connolly on August 6 th 2015. 
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On September 3, 2015, a Confidential Human Source (CHS) provided the FBI|_ 
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Date of transcription 09/09/2015 


(U// FOUO 
response from 


On September 3 , 2015 , SA 


received a 


brecrard incf a preservation request for the account 
The response is attached to this 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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Title: (□) The Submission of FD-340 Date: 09/16/2015 
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From: WASHINGTON FIELD 

WF-CI13 

Contact: I 


Approved By: SSA 


Drafted By: 


Case ID #: 




(S//NP) [ 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U//P QU Q) To document the submission of FD-340 (1A) to the 

1A sub-file of the captioned case file. 



iU) 


Full Investigation Initiated: 07/10/2015 


Reference : 


Serial 9 


Enclosure (s) : Enclosed are the following items: 

1. Original notes of FBI & ICIG meeting held on July 22, 2015, 


Details : 

( //1UUU) This communication servers to document the submission of a 
FD-340 (1A) to the 1A sub-file of the captioned case file. 
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MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U//TTTTO) To document the submission of FD-340 (1A) to the 

1A sub-file of the captioned case file. 



Full Investigation Initiated: 07/10/2015 


Reference : 


Serial 


18 


Enclosure (s) : Enclosed are the following items: 
1 . (^S^ /NF) Original preservation response from 
on July 3 1 , 2015. 


Details: 

(U// FQUO ) This communication serves to document the submission of 
FD-340 (1A) to the 1A sub-file of the captioned case file. 
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Date of transcription 09/15/2015 


On September 14, 2015, Patrick F. Kennedy, the Under Secretary of State for Management, U.S. 
Department of State, Washington, D.C., sent an LHM to FBI Director James B. Comey regarding the 
captioned investigation. 


The LHM is enclosed in the attached 1 A. 
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sub-file of the captioned case file. 
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Serial 


22 


■ITi 


Enclosure (s) : Enclosed are the following i tems : 
1. ()^/ Original notes re interview of 

2015 1 


on July 30. 


Details : 

(U/ /FQUQ) This communication servers to document the submission of a 
FD-340 (1A) to the 1A sub-file of the captioned case file. 
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sub-file of the captioned case file. 



Full Investigation Initiated: 
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Reference : 


Enclosure (s) : Enclosed are 
iU;f 1 . (Xz/ttfl Original notes 
04 f 2015 



A. linick on August 


Details : 


(U//F0U0) This communication servers to document the submission of a 
FD-34 0 ( 1A) to the 1A sub- file of the captioned case f ile , 
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Serial 29 


Enclosure (s) : Enclosed are the following i tems : 
ill) 1. Original notes re interview of 

2015. 


on August 07, 


Details : 

(U//£O0O r ) This communication servers to document the submission of a 
FD-340 (1A) to the 1A sub-file of the captioned case file. 
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: Enclosed are the following i tems : 
Original notes re interview of I" 


on July 31, 


Details: 

(U/ /P OU O) This communication servers to document the submission of a 
FD-340 (1A) to the 1A sub-file of the captioned case. 
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Full Investigation Initiated: 07/10/2015 
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1875 Pennsylvania Ave NW 
Washington, District Of Columbia 

ftadcelpt Given? : No 

Holdilit Office: WASHINGTON FIELD 


Details : 


No Details Provided 


Item Type 

IB Digital !]]) 


Description 

(xj 1 Apple Mac Book Air Laptop S/N C02LF0ICFM74 

Collected On; 09/24 /2015 

Seizing Indivi dual: I 
Collected By: 

Location Area: NA 
Specific Location: NA 
Device Type : Computer 
Number of Devices Collected: 1 
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Williams & Connolly LLP 
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IB Digital Seagate Desktop External Hard Drive 1000 GB, S/N 

2GHJ026M/ Power Supply/USB Cable 
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REASON: 1.4 (C) 

DECLASSIFY ON: 12-31-2040 
DATE : 11 - 0 3-2 01 £ 


FD-1087 (Rev. 5-S-10) 


/H OP OR H 



FEDERAL BUREAU OF INVESTIGATION 

Collected Item Log 


Event Title : (S) 


Date: 10/05/2015 


bl 

b3 

b7E 


Approved By : 


Drafted By : 


Case ID 


#: 




(s//wr) T 

MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 



iU| Collected From.: X> Wilmer Hale 

1875 Pennsylvania Ave NW 

Washington, District Of Columbia 20006 


Receipt Given? : No 

Holding Office: WASHINGTON FIELD 


b6 

b7C 


bl 

b3 

b7E 


Details : No Details Provided 


Item Type 

IB Digital \]J'j 


Description 

Apple Mac Pro S/N W893361H6644 , Power Cord 

Collected On: 10/05/2015 

Seizing Indivi dual: I | 

Collected By: 

Location Area: NA 
Specific Location: NA 
Device Type: Hard Drive 
Number of Devices Collected: 1 


b6 

b7C 


:t//w odoi w - 


This document contains neither recommendations nor conclusions ot the FBI. It is the property of the FBI and is loaned to your agency; it and its 
contents are not to be distributed outside your agency. 


HRC-733 



SEpBgT/ /HOFORH 


Title: (S)[ 

Re: I 


10 / 05/2015 


♦ ♦ 


S^BK^T/ 


SgftKET / / M Q POW T 




bS 

hlC 



HRC-741 




h€ 

blC 



HRC-743 



FD-302a (Rev. 10-6-95} 



ALL IMFORIiATIO H CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 11-0 3-2 0 1 6 BY J76J1BTS0 NSICC 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/07/2015 


On October 6 ? 2013 


NW Suite 300, Washington D.C. 20005, teleph one! 


Attorney at Law, Da; 


Pitney LLP, 1100 New York Ave, 


counsel for Datto Inc., electronically mailed SaT" 
received a letter from Chairman Johnson of the Hi 
regarding the captioned matter. 


y ritney 
1 email r 


] external 


b6 

b7C 


|to advise that Datto Inc., had 

omeland Security & Government Affairs Committee 


A copy of the email and attached letter from Chairman Johnson are enclosed in a 1 A. 


Investigation on 10/07/2015 at Washington. DC 


File# 


'KQ*i 


By SAl 


Date dictated N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


b3 

b7E 


b6 

b7C 


HRC-744 




b3 

hS 

blC 

b7E 


/ 


HRC-754 




b3 

b6 

b7C 

b7E 


HRC-758 ' 



s 



T 


b6 

b7C 



HRC-768 



(Rev. 05-01-2008) 



CLASSIFIED BY: 1-13 ICG J7SJ1STSO 
REASON: 1.4 (C) 

DECLASSIFY ON: 12-31-2040 
CATE: 11-03-2016 



FEDERAL BUREAU OF INVESTIGATION 


ALL I Mf FORIIAT IGN CONTAINED 
HEREIN IS UHC LASS IFIEE EXCEPT 
WHERE SHOWN OTHERWISE 


Title: (U// FOUO ) Transcript of Congressional Testimony 

Date: 11/23/15 

To: Washington Field 

From: Washington Field 

Cl- 12 

Contact: SOS b6 

blC 


iff! 



bl 

b3 

b7E 


MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U// FOUO) Documentation of Congressional testimony 

transcript 

Enclosure (s) : Enclosed are the following items: 

1. (U/ /FOUO) CD with digital copy of Congressional testimony 


C las&tfiad^Bi 
Derived Froi 


H83J83T4' 


dated 20130301 


fsify On: 20401231 

Details: (U/ / - TOUO j Former Secretary of State Hillary Clint 
testified before the United States House of Re presentatives 
Committee on Benghazi on 10/22/15. FBI Attorney 


accessed a transcript of the testimony via the Washington p| 
or about 10/22/1 5 and emailed the document to Staff Operat 


Specialist (SOS) 


on 10/23/15. A 


copy of the verbatim transcript of Clinton's testimony wil 
maintained on a CD via the associated 1A. 





♦ ♦ 


SfaSgET / /NOFORN 


HRC-769 


HRC-840 


(Rev. 05-01-2008) 


CLASSIFIED BY: HSICG JTSJISTSD 
RZA3GH: 1 . 4 (C) 


LASSIFY GN: 12-31-2041 


DATB : 11-09-2016 


SEpfC^T 


|^//H OFOnN 

FEDERAL BUREAU OF INVESTIGATION 


ALL IHFQRMAT ION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHCWH OTHERWISE 


Precedence: ROUTINE 


Date : 1 / 5/2016 


To: Washington Field 


From: Washington Field 



UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 

(flj Synopsis: (X//-WF7 Provides FBI Washington Field Office (WFO) the 

conditional authority of Original Classifying Authority (OCA) E. W. 
Priestap, Assistant Director, Counterintelligence Division (CD) , to 
show SIDNEY BLUMENTHAL, and his legal counsel, an email sent by 
BLUMENTHAL that has since been deemed to contain classified 
information. 


■;Ui 



ated 20130301 


Details: ygf/ /•WF') This communication requests the conditional 

authority or Original Classifying Authority (OCA) E. W. Priestap, 
Assistant Director, Counterintelligence Division (CD) , to show 
SIDNEY BLUMENTHAL, and his legal counsel, an email sent by BLUMENTHAL 
that has since been deemed to contain classified FBI* information. 


■ D) For background informat ion , WFO will be conducting an 

interview of BLUMENTHAL regarding his knowledge of matters relevant 


b6 

b7C 


bl 

b3 

b7E 




T/ /NOFORN 


HRC-841 



- 01 - 2008 ) 


sijpe^^T 


T//W OFODH 


FEDERAL BUREAU OF INVESTIGATION 


to the captioned investigation. The interview will be conducted on 
1/7/2016 and will also be attended by his legal counsel from Sidley 
Austin LLP and attorneys from the Department of Justice. 

/WF) During the course of the interview, WFO plans to show 
BLUMENTHAL and his counsel a copy of the attached email that he sent 
on April 23, 2010 to the former Secretary of State, Hillary Clinton. 
Showing the email to BLUMENTHAL and his counsel will allow WFO to 
pursue a logical line of questions regarding the circumstances in 
which the email was sent. During a recent classification review the 
FBI deemed that portions of the email contain information classified 
at SECRET level. 

) WFO confirms that showing the email will not result in 
previous unknown sources or informants being revealed, will not 
negatively impact other case equities, and will not disclose 
information from any other agency or foreign government. 

a result, CD provides one-time OCA authority for FBI WFO 
to show BLUMENTHAL and his legal counsel the email above during its 
planned interview. 

Prior to showing BLUMENTHAL, and his legal counsel the 
email, BLUMENTHAL and his legal counsel should execute a 
non-disclosure agreement. In addition, FBI WFO should advise 
BLUMENTHAL of his past and present obligations to protect classified 
information including the contents of the email.-. FBI WFO will 
document these discussions in its FD-302. 

Any questions or concerns regarding this matter can be addressed 
to SA\ I 


♦ ♦ 




T/ /HOFORN 






FD- 1087a (Rev. 5-8-10) 


FBI IHFG. 

CLASSIFIED BY: H5ICG J75J1STE0 
REASCtl: 1.4 (C) 

DECLASSIFY OF r 12-31-20 41 
CATE: 11-03-2016 


SEfe^r/ /m of obw - 

FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 



b7E 


Event Title : 
Approved By: 
Drafted By: 
Case ID #; 


(S) 


Date: 01/08/2016 


b6 

b7C 



MISHANDLING OF CLASSIFIED; 

UNKNOWN SUBJECT OR COUNTRY; 

SENSITIVE INVESTIGATIVE MATTER (SIM) 


FBI 

r&ii 

fsify On: 2T>2$1231 
Full Investigation Initiated: 07/10/2015 
Collected By: Missing on Missing 
Collected From: Department of State 
Receipt Given? : No 
Holding office: WASHINGTON FIELD 
Item Type Description 

IB Digital ; U J 1 Thumb Drive with Green Unclassified Sticker On 

It 

Collected On: 01/07 /201 6 
Seizing Individual : 


bl 

b3 

b7E 


Located By: 
Location Area: NA 
Specific Location: 


b6 

b7C 


Na 


Device Type: USB Micro Storage Device (thumb drive) 
Number of Devices Collected: 1 




T/ / WOPO RW 


HRC-850 



SEpfl^T/ /MQ POIW 


Title: (S) 



bl 

b3 

b7E 

Re: 


01/08/2016 

IB Digital 


1 Thumb Drive with Red Secret Sticker On It 




Collected On: 01/07/2016 




. t f — 

Seizing Individual : 1 

b6 


Located By: 

Location Area: NA 
Specific Location : NA 

Device Type: USB Micro Storage Device (thumb drive) 
Number of Devices Collected: 1 


b7C 


♦♦ 


SEpKET / /HOPOPM 



